Delegated Access with OAuth

Presentatie gegeven tijdens devCampNoord '24 in Kinepolis Groningen.

1. Delegated Access with OAuth Why Developers Should Care Annejan Barelds Software Architect DevCampNoord April 4th, 2024
2. Annejan Barelds Software Architect - 4Dotnet Azure – .NET – Architecture – Consultancy https://www.linkedin.com/in/barelds/ https://github.com/AnnejanBarelds
3. Delegated Access OAuth 2.0 On-Behalf-Of
4. 2008 Alice Bob Charlie Alice Bob Charlie App ID
7. App ID Alice Bob Charlie
8. App ID Alice Bob Charlie App ID App ID ? ?
10. Office 365 The Need for Zero Trust
11. User Role Group Device Config Location Last Sign-in Conditional access risk Health/Integrity Client Config Last seen High Medium Low Firewall Intrusion Detection/Prevention Forward/Reverse Proxy Source: IP Address/Port Destination: IP Address/Port Signatures Analytics Allow List Authentication Intranet Resources Actions: • Allow • Allow Restricted • Require MFA • Block • Force Remediation Actions: • Allow • Block Device
12. User Role Group Device Config Location Last Sign-in Conditional access risk High Medium Low Intranet Resources Actions: • Allow • Allow Restricted • Require MFA • Block • Force Remediation Actions: • Allow • Block Health/Integrity Client Config Last seen Device Identity Permissions App Identity Permissions API Firewall Intrusion Detection/Prevention Forward/Reverse Proxy Source: IP Address/Port Destination: IP Address/Port Signatures Analytics Allow List Authentication
13. OK, so we need delegated access. How does it work?
14. Resource Server Client IdP Resource Owner Data Scopes: - Read - Write - … Roles: - Owner - Reader App App Required access: - RS/Read AT IT AT SP SP RS/Read openid Consent?
15. AT AT ? Resource Server Client IdP Resource Owner Data Scopes: - Read - Write - … Roles: - Owner - Reader App Required access: - RS/Read IT AT SP SP RS/Read openid IdP App AT API Scopes: - Read Required access: - API/Read Required access: - RS/Read App SP AT AT AT API/Read RS/Read
16. https://www.youtube.com/watch?v=WVNvoiA_ktw John Savill's Technical Training
17. Demo time
18. So it’s all rainbows and unicorns?
19. OAuth On-Behalf-Of is about user context You need user context for - Autonomy - Auditing - Access checks Microsoft Entra ID takes some getting-used-to MSAL solves the coding part
20. Thanks!