Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Delegated Access with OAuth
Search
devNetNoord
April 04, 2024
Technology
0
16
Delegated Access with OAuth
Presentatie gegeven tijdens devCampNoord '24 in Kinepolis Groningen.
devNetNoord
April 04, 2024
Tweet
Share
More Decks by devNetNoord
See All by devNetNoord
Copilot Beyond the Basics
devnetnoord
0
35
The Blazor Multiverse
devnetnoord
0
20
De Architectuur Odyssee
devnetnoord
0
12
Azure Kubernetes Service Quickstart
devnetnoord
0
16
The Office Copilot
devnetnoord
0
12
Navigating Cloud Sustainability: Insights and Strategies
devnetnoord
0
15
Machine Learning 101
devnetnoord
0
10
Vector search and state-of-the-art retrieval for generative AI apps
devnetnoord
0
38
Reviewing NuGet Packages security easily using OpenSSF Scorecard
devnetnoord
0
22
Other Decks in Technology
See All in Technology
RAGHack: Building RAG apps in Python
pamelafox
0
130
waitany と waitall を作った話
mrkn
0
120
突撃! 隣のAmazon Bedrockユーザー 〜YouはどうしてAWSで?〜
minorun365
PRO
2
200
MySQLユーザ会なにやってるの?とおさそいと / たいへんなのw
sakaik
1
110
2024年版 運用者たちのLLM
nwiizo
3
410
EitherT_with_Future
aoiroaoino
1
900
Envoy External AuthZとgRPC Extensionを利用した「頑張らない」Microservices認証認可基盤
andoshin11
0
200
Dive Deep in Cloud Run: Automatic Base Image update
aoto
PRO
0
900
Azure SQL Database Hyperscale HA レプリカの監視
sansantech
PRO
0
210
日経電子版から始まった内製開発の現在地と向き合っている課題/inhouse
nishiuma
0
240
Building Static Websites with Sculpin
opdavies
0
1.5k
Evolving DevOps Teams and Flexible Organizational Culture
kakehashi
1
180
Featured
See All Featured
Faster Mobile Websites
deanohume
304
30k
How To Stay Up To Date on Web Technology
chriscoyier
785
250k
How to name files
jennybc
75
98k
The Invisible Customer
myddelton
119
13k
Web development in the modern age
philhawksworth
204
10k
What's new in Ruby 2.0
geeforr
340
31k
Designing for humans not robots
tammielis
248
25k
WebSockets: Embracing the real-time Web
robhawkes
59
7.3k
Typedesign – Prime Four
hannesfritz
39
2.3k
Design and Strategy: How to Deal with People Who Don’t "Get" Design
morganepeng
123
18k
BBQ
matthewcrist
83
9.1k
Creating an realtime collaboration tool: Agile Flush - .NET Oxford
marcduiker
22
1.7k
Transcript
Delegated Access with OAuth Why Developers Should Care Annejan Barelds
Software Architect DevCampNoord April 4th, 2024
Annejan Barelds Software Architect - 4Dotnet Azure – .NET –
Architecture – Consultancy https://www.linkedin.com/in/barelds/ https://github.com/AnnejanBarelds
Delegated Access OAuth 2.0 On-Behalf-Of
2008 Alice Bob Charlie Alice Bob Charlie App ID
2016
2024
App ID Alice Bob Charlie
App ID Alice Bob Charlie App ID App ID ?
?
None
Office 365 The Need for Zero Trust
User Role Group Device Config Location Last Sign-in Conditional access
risk Health/Integrity Client Config Last seen High Medium Low Firewall Intrusion Detection/Prevention Forward/Reverse Proxy Source: IP Address/Port Destination: IP Address/Port Signatures Analytics Allow List Authentication Intranet Resources Actions: • Allow • Allow Restricted • Require MFA • Block • Force Remediation Actions: • Allow • Block Device
User Role Group Device Config Location Last Sign-in Conditional access
risk High Medium Low Intranet Resources Actions: • Allow • Allow Restricted • Require MFA • Block • Force Remediation Actions: • Allow • Block Health/Integrity Client Config Last seen Device Identity Permissions App Identity Permissions API Firewall Intrusion Detection/Prevention Forward/Reverse Proxy Source: IP Address/Port Destination: IP Address/Port Signatures Analytics Allow List Authentication
OK, so we need delegated access. How does it work?
Resource Server Client IdP Resource Owner Data Scopes: - Read
- Write - … Roles: - Owner - Reader App App Required access: - RS/Read AT IT AT SP SP RS/Read openid Consent?
AT AT ? Resource Server Client IdP Resource Owner Data
Scopes: - Read - Write - … Roles: - Owner - Reader App Required access: - RS/Read IT AT SP SP RS/Read openid IdP App AT API Scopes: - Read Required access: - API/Read Required access: - RS/Read App SP AT AT AT API/Read RS/Read
https://www.youtube.com/watch?v=WVNvoiA_ktw John Savill's Technical Training
Demo time
So it’s all rainbows and unicorns?
OAuth On-Behalf-Of is about user context You need user context
for - Autonomy - Auditing - Access checks Microsoft Entra ID takes some getting-used-to MSAL solves the coding part
Thanks!