OAuth2, OIDC & JWT - Important Basics!

Transcript

1. OAUTH2, OIDC & JWT
   NIKO KÖBLER (@DASNIKO)
   KEYCLOAK-EXPERTE.DE
   

   View Slide

2. Niko Köbler | keycloak-experte.de
   Keycloak IAM & SSO
   ABOUT ME
   ▸ Freelance Consultant/Architect/Developer/Trainer
   ▸ Doing stuff with & without Computers, Software, > 23 yrs
   ▸ Mr. Keycloak > 8 yrs (since 1.x)
   ▸ Co-Lead of JUG DA (https://www.jug-da.de / @JUG_DA)
   ▸ Author of „Serverless Computing in AWS Cloud“
   serverlessbuch.de
   ▸ Web: www.n-k.de / Twitter: @dasniko
   ▸ YouTube: youtube.com/@dasniko
   

   View Slide

3. OAUTH2
   OIDC
   JWT
   

   View Slide

4. AUTHORIZATION
   AUTHENTICATION
   

   View Slide

5. View Slide

6. View Slide

7. View Slide

8. View Slide

9. View Slide

10. View Slide

11. View Slide

12. OAUTH2
    AUTHORIZATION, NOT AUTHENTICATION!
    IETF, RFC 6749, 2012
    The OAuth 2.0 authorization framework
    enables a 3rd-party application to obtain
    limited access to an HTTP service.
    

    View Slide

13. OAUTH2 GRANT TYPES
    GRANT TYPE APPS
    Authorization Code Web, Apps
    Implicit JavaScript, etc.
    Resource Owner Password Credentials Apps
    Client Credentials Web
    Refresh Web, Apps
    

    View Slide

14. OAUTH2 TERMS
    Resource Owner
    Client
    Authorization Server
    Resource Server
    Redirect URI
    Response Type
    Scope
    Consent
    Client ID
    Client Secret
    Authorization Code
    Access Token
    

    View Slide

15. ACCESS TOKEN
    {
    "access_token": "6041a9d7-8c39-4945-b7c6-eaf7bd5d0907",
    "token_type": "Bearer",
    "expires_in": 3600,
    "refresh_token": "e339b569-6d95-482d-9534-5c0147136ab0"
    }
    

    View Slide

16. OPEN ID CONNECT
    AUTHENTICATION LAYER ON TOP OF OAUTH 2.0
    ‣ verify the identity of an end-user
    ‣ obtain basic profile information about the user
    ‣ RESTful HTTP API, using JSON as data format
    ‣ allows clients of all types (web-based, mobile, JavaScript)
    OPENID FOUNDATION, 2014
    

    View Slide

17. View Slide

18. OPEN ID CONNECT
    AUTHENTICATION LAYER ON TOP OF OAUTH 2.0
    ‣ verify the identity of an end-user
    ‣ obtain basic profile information about the user
    ‣ RESTful HTTP API, using JSON as data format
    ‣ allows clients of all types (web-based, mobile, JavaScript)
    OPENID FOUNDATION, 2014
    

    View Slide

19. OIDC
    {
    "access_token": "6041a9d7-8c39-4945-b7c6-eaf7bd5d0907",
    "token_type": "Bearer",
    "expires_in": 3600,
    "identity_token": "???",
    "refresh_token": "e339b569-6d95-482d-9534-5c0147136ab0"
    }
    OPENID CONNECT ADDS THE IDENTITY TOKEN
    

    View Slide

20. JWT
    JSON WEB TOKEN
    RFC 7519 STANDARD, 2015
    

    View Slide

21. JWT
    eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOi
    IxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiY
    WRtaW4iOnRydWV9.TJVA95OrM7E2cBab30RMHrH
    DcEfxjoYZgeFONFh7HgQ
    BASE64 ENCODED
    

    View Slide

22. JSON WEB TOKEN
    

    View Slide

23. JWT PAYLOAD
    {
    "sub": "1234567890",
    "iss": "https://sso.myapi.com",
    "aud": "myApi",
    "exp": 1479814753,
    "name": "John Doe",
    "admin": true
    }
    RESERVED CLAIMS:
    sub, iss, aud, exp
    

    View Slide

24. OPEN ID CONNECT STANDARD CLAIMS
    http://openid.net/specs/openid-connect-core-1_0.html
    

    View Slide

25. TOKEN RESPONSE
    {
    "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
    "token_type": "Bearer",
    "expires_in": 3600,
    "identity_token": "eyJhbGciOiAiUlMyNTYiLCJ0eXAiOiAiSldUIn0…",
    "refresh_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
    }
    

    View Slide

26. OIDC
    OPENID CONNECT ADDS THE
    USERINFO ENDPOINT
    

    View Slide

27. THANK YOU.
    ANY QUESTIONS?
    Slides: https://speakerdeck.com/dasniko
    Niko Köbler | www.n-k.de | niko@n-k.de | @dasniko
    OAUTH2, OIDC & JWT
    

    View Slide