Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Delegated Access with OAuth
Search
devNetNoord
April 04, 2024
Technology
0
30
Delegated Access with OAuth
Presentatie gegeven tijdens devCampNoord '24 in Kinepolis Groningen.
devNetNoord
April 04, 2024
Tweet
Share
More Decks by devNetNoord
See All by devNetNoord
Gebruik je broncode als documentatie voor je stakeholders
devnetnoord
0
19
Efficient and Secure Software Delivery with Azure Deployment Environments and Dev Box
devnetnoord
0
22
Toepassing van AI in de zorg; hype, hoop en haalbaarheid
devnetnoord
0
45
What's new with Azure Bicep?
devnetnoord
0
29
Copilot Beyond the Basics
devnetnoord
0
80
The Blazor Multiverse
devnetnoord
0
74
De Architectuur Odyssee
devnetnoord
0
37
Azure Kubernetes Service Quickstart
devnetnoord
0
50
The Office Copilot
devnetnoord
0
24
Other Decks in Technology
See All in Technology
Modernizing Virtio GPU: A Rust-Powered Approach with vhost-device-gpu
ennael
PRO
0
100
研究開発部メンバーの働き⽅ / Sansan R&D Profile
sansan33
PRO
3
20k
社内お問い合わせBotの仕組みと学び
nish01
0
460
Access-what? why and how, A11Y for All - Nordic.js 2025
gdomiciano
1
120
動画データのポテンシャルを引き出す! Databricks と AI活用への奮闘記(現在進行形)
databricksjapan
0
150
生成AI_その前_に_マルチクラウド時代の信頼できるデータを支えるSnowflakeメタデータ活用術.pdf
cm_mikami
0
120
ACA でMAGI システムを社内で展開しようとした話
mappie_kochi
1
290
BtoBプロダクト開発の深層
16bitidol
0
380
AWSにおけるTrend Vision Oneの効果について
shimak
0
130
業務自動化プラットフォーム Google Agentspace に入門してみる #devio2025
maroon1st
0
200
小学4年生夏休みの自由研究「ぼくと Copilot エージェント」
taichinakamura
0
500
自動テストのコストと向き合ってみた
qa
0
200
Featured
See All Featured
Reflections from 52 weeks, 52 projects
jeffersonlam
352
21k
KATA
mclloyd
32
15k
Java REST API Framework Comparison - PWX 2021
mraible
33
8.8k
Measuring & Analyzing Core Web Vitals
bluesmoon
9
610
The Myth of the Modular Monolith - Day 2 Keynote - Rails World 2024
eileencodes
26
3.1k
The Invisible Side of Design
smashingmag
301
51k
Put a Button on it: Removing Barriers to Going Fast.
kastner
60
4k
The Cost Of JavaScript in 2023
addyosmani
53
9k
XXLCSS - How to scale CSS and keep your sanity
sugarenia
248
1.3M
4 Signs Your Business is Dying
shpigford
185
22k
RailsConf 2023
tenderlove
30
1.2k
What's in a price? How to price your products and services
michaelherold
246
12k
Transcript
Delegated Access with OAuth Why Developers Should Care Annejan Barelds
Software Architect DevCampNoord April 4th, 2024
Annejan Barelds Software Architect - 4Dotnet Azure – .NET –
Architecture – Consultancy https://www.linkedin.com/in/barelds/ https://github.com/AnnejanBarelds
Delegated Access OAuth 2.0 On-Behalf-Of
2008 Alice Bob Charlie Alice Bob Charlie App ID
2016
2024
App ID Alice Bob Charlie
App ID Alice Bob Charlie App ID App ID ?
?
None
Office 365 The Need for Zero Trust
User Role Group Device Config Location Last Sign-in Conditional access
risk Health/Integrity Client Config Last seen High Medium Low Firewall Intrusion Detection/Prevention Forward/Reverse Proxy Source: IP Address/Port Destination: IP Address/Port Signatures Analytics Allow List Authentication Intranet Resources Actions: • Allow • Allow Restricted • Require MFA • Block • Force Remediation Actions: • Allow • Block Device
User Role Group Device Config Location Last Sign-in Conditional access
risk High Medium Low Intranet Resources Actions: • Allow • Allow Restricted • Require MFA • Block • Force Remediation Actions: • Allow • Block Health/Integrity Client Config Last seen Device Identity Permissions App Identity Permissions API Firewall Intrusion Detection/Prevention Forward/Reverse Proxy Source: IP Address/Port Destination: IP Address/Port Signatures Analytics Allow List Authentication
OK, so we need delegated access. How does it work?
Resource Server Client IdP Resource Owner Data Scopes: - Read
- Write - … Roles: - Owner - Reader App App Required access: - RS/Read AT IT AT SP SP RS/Read openid Consent?
AT AT ? Resource Server Client IdP Resource Owner Data
Scopes: - Read - Write - … Roles: - Owner - Reader App Required access: - RS/Read IT AT SP SP RS/Read openid IdP App AT API Scopes: - Read Required access: - API/Read Required access: - RS/Read App SP AT AT AT API/Read RS/Read
https://www.youtube.com/watch?v=WVNvoiA_ktw John Savill's Technical Training
Demo time
So it’s all rainbows and unicorns?
OAuth On-Behalf-Of is about user context You need user context
for - Autonomy - Auditing - Access checks Microsoft Entra ID takes some getting-used-to MSAL solves the coding part
Thanks!