Just Enough OpenID Connect @ MPUG

Presented to Melbourne Python User Group

Transcript

1. JUST ENOUGH OPENID CONNECT A SECURITY PROTOCOL IN 3 ACTS
2. About Me @falican
3. The Scenario Talking OIDC Token Expiration More Using Client Credentials @falican
4. GRACE & HER ML MODEL @falican THE SCENARIO
5. GRACE HOOPER DATA SCIENTIST Grace has a strong maths & stats background and recently joined Rail Corp, working in their fledgling data science department. EXPERIENCE § Matlab § R § Power BI § Excel § Tableau @falican
6. When Will A Wagon Need Maintenance? @falican THE SCENARIO
7. Hand Cranking the Predictions 1. Export a CSV from data warehouse via Power BI. 2. Run the model overnight. 3. Upload CSV via Power BI to data warehouse. 4. Generate the PDF report with Power BI. 5. Email report to stakeholders. @falican THE SCENARIO
8. The Automation Plan 1. Use Python to download the data from the data warehouse. 2. Use Python to upload the predictions to the data warehouse. 3. Run the model on a server. @falican THE SCENARIO
9. HERE ARE YOUR CLIENT CREDENTIALS @falican TALKING OPENID CONNECT (OIDC)
10. Off to a Slow Start @falican From: Grace Hooper <grace.hooper@railcorp.com> To: Avery Adams <avery.adams@railcorp.com> Subject: accessing the warehouse with python Hi Avery, I need to download & upload data to the warehouse using python. Can you help? - Grace From: Avery Adams <avery.adams@railcorp.com> To: Grace Hooper <grace.hooper@railcorp.com> Subject: RE: accessing the warehouse with Python Hi Grace, the warehouse documentation says you can use http & "openid connect" and that I need to give you some client credentials. I've generated you some credentials and included them below along with some other data the docs say you will need. You are the first person to do this so can you let me know how you get on? Here are your client credentials: Client id: gracehooper Client secret: eca4368d5b92c3ae5f46a5404b5bd47f Grant type: password Token url: https://dwh.railcorp.com/oidc/token TALKING OPENID CONNECT
11. OpenID Connect? OpenID Connect 1.0 is a simple identity layer on top of the OAuth 2.0 protocol. It allows clients to verify the identity of the end-user based on the authentication performed by an authorization server, as well as to obtain basic profile information about the end-user in an interoperable and rest-like manner. Authentication? So something like HTTP Basic Auth? @falican TALKING OPENID CONNECT
12. So Something Like HTTP Basic Auth? 1) Source: http://docs.python-requests.org/en/master/user/authentication/ @falican TALKING OPENID CONNECT
13. Grant Type? Client id: gracehooper Client secret: eca4368d5b92c3ae5f46a5404b5bd47f Grant type: password Token url: https://dwh.railcorp.com/oidc/token @falican TALKING OPENID CONNECT
14. Resource Owner Password Grant Source: https://github.com/FrankHassanabad/Oauth2orizeRecipes (MIT License) @falican TALKING OPENID CONNECT
15. Python (Batteries Included) 1) Source: http://docs.python-requests.org/en/master/user/authentication/ @falican TALKING OPENID CONNECT
16. It Works! @falican TALKING OPENID CONNECT
17. WHY IS THIS REQUEST FAILING? @falican REFRESH TOKENS
18. This Should Work?! @falican TOKEN EXPIRATION
19. TokenExpiredError? @falican TOKEN EXPIRATION
20. That Fixed It @falican TOKEN EXPIRATION
21. DON’T GIVE OUT YOUR PASSWORD @falican USING CLIENT CREDENTIALS
22. What About Other Workflows? 1) Source: https://requests-oauthlib.readthedocs.io/en/latest/oauth2_workflow.html#available-workflows @falican USING CLIENT CREDENTIALS
23. Client Credentials Grant 1) Source: http://requests-oauthlib.readthedocs.io/en/latest/oauth2_workflow.html#backend-application-flow @falican USING CLIENT CREDENTIALS
24. Client Credentials Grant 1) Source: https://github.com/FrankHassanabad/Oauth2orizeRecipes/wiki/Security-Scenarios (MIT) @falican USING CLIENT CREDENTIALS
25. Well That is Simple! @falican USING CLIENT CREDENTIALS
26. FURTHER READING @falican APPENDIX A
27. Thanks • Auth0 OpenID Connect docs https://auth0.com/docs/protocols/oidc • Requests-OAuthlib: OAuth for Humans http://requests-oauthlib.readthedocs.io/en/latest/ @falican