Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Delegated Access with OAuth
Search
devNetNoord
April 04, 2024
Technology
0
25
Delegated Access with OAuth
Presentatie gegeven tijdens devCampNoord '24 in Kinepolis Groningen.
devNetNoord
April 04, 2024
Tweet
Share
More Decks by devNetNoord
See All by devNetNoord
Gebruik je broncode als documentatie voor je stakeholders
devnetnoord
0
13
Efficient and Secure Software Delivery with Azure Deployment Environments and Dev Box
devnetnoord
0
19
Toepassing van AI in de zorg; hype, hoop en haalbaarheid
devnetnoord
0
29
What's new with Azure Bicep?
devnetnoord
0
16
Copilot Beyond the Basics
devnetnoord
0
67
The Blazor Multiverse
devnetnoord
0
59
De Architectuur Odyssee
devnetnoord
0
29
Azure Kubernetes Service Quickstart
devnetnoord
0
40
The Office Copilot
devnetnoord
0
19
Other Decks in Technology
See All in Technology
rubygem開発で鍛える設計力
joker1007
2
180
ハノーバーメッセ2025座談会.pdf
iotcomjpadmin
0
160
How Community Opened Global Doors
hiroramos4
PRO
1
110
AWS CDK 実践的アプローチ N選 / aws-cdk-practical-approaches
gotok365
6
680
mrubyと micro-ROSが繋ぐロボットの世界
kishima
2
110
Welcome to the LLM Club
koic
0
160
Fabric + Databricks 2025.6 の最新情報ピックアップ
ryomaru0825
1
120
Кто отправит outbox? Валентин Удальцов, автор канала Пых
lamodatech
0
330
BrainPadプログラミングコンテスト記念LT会2025_社内イベント&問題解説
brainpadpr
1
160
フィンテック養成勉強会#54
finengine
0
160
2年でここまで成長!AWSで育てたAI Slack botの軌跡
iwamot
PRO
4
640
Microsoft Build 2025 技術/製品動向 for Microsoft Startup Tech Community
torumakabe
2
250
Featured
See All Featured
The Power of CSS Pseudo Elements
geoffreycrofte
77
5.8k
Raft: Consensus for Rubyists
vanstee
140
7k
The MySQL Ecosystem @ GitHub 2015
samlambert
251
13k
Let's Do A Bunch of Simple Stuff to Make Websites Faster
chriscoyier
507
140k
Practical Tips for Bootstrapping Information Extraction Pipelines
honnibal
PRO
20
1.3k
For a Future-Friendly Web
brad_frost
179
9.8k
Art, The Web, and Tiny UX
lynnandtonic
299
21k
Building Adaptive Systems
keathley
43
2.6k
Testing 201, or: Great Expectations
jmmastey
42
7.5k
GraphQLとの向き合い方2022年版
quramy
47
14k
Typedesign – Prime Four
hannesfritz
42
2.7k
Refactoring Trust on Your Teams (GOTO; Chicago 2020)
rmw
34
3k
Transcript
Delegated Access with OAuth Why Developers Should Care Annejan Barelds
Software Architect DevCampNoord April 4th, 2024
Annejan Barelds Software Architect - 4Dotnet Azure – .NET –
Architecture – Consultancy https://www.linkedin.com/in/barelds/ https://github.com/AnnejanBarelds
Delegated Access OAuth 2.0 On-Behalf-Of
2008 Alice Bob Charlie Alice Bob Charlie App ID
2016
2024
App ID Alice Bob Charlie
App ID Alice Bob Charlie App ID App ID ?
?
None
Office 365 The Need for Zero Trust
User Role Group Device Config Location Last Sign-in Conditional access
risk Health/Integrity Client Config Last seen High Medium Low Firewall Intrusion Detection/Prevention Forward/Reverse Proxy Source: IP Address/Port Destination: IP Address/Port Signatures Analytics Allow List Authentication Intranet Resources Actions: • Allow • Allow Restricted • Require MFA • Block • Force Remediation Actions: • Allow • Block Device
User Role Group Device Config Location Last Sign-in Conditional access
risk High Medium Low Intranet Resources Actions: • Allow • Allow Restricted • Require MFA • Block • Force Remediation Actions: • Allow • Block Health/Integrity Client Config Last seen Device Identity Permissions App Identity Permissions API Firewall Intrusion Detection/Prevention Forward/Reverse Proxy Source: IP Address/Port Destination: IP Address/Port Signatures Analytics Allow List Authentication
OK, so we need delegated access. How does it work?
Resource Server Client IdP Resource Owner Data Scopes: - Read
- Write - … Roles: - Owner - Reader App App Required access: - RS/Read AT IT AT SP SP RS/Read openid Consent?
AT AT ? Resource Server Client IdP Resource Owner Data
Scopes: - Read - Write - … Roles: - Owner - Reader App Required access: - RS/Read IT AT SP SP RS/Read openid IdP App AT API Scopes: - Read Required access: - API/Read Required access: - RS/Read App SP AT AT AT API/Read RS/Read
https://www.youtube.com/watch?v=WVNvoiA_ktw John Savill's Technical Training
Demo time
So it’s all rainbows and unicorns?
OAuth On-Behalf-Of is about user context You need user context
for - Autonomy - Auditing - Access checks Microsoft Entra ID takes some getting-used-to MSAL solves the coding part
Thanks!