OAuth 101

Transcript

1. 1.

   None
2. 2.

   Nick Jackson Web Monkey University of Lincoln @jacksonj04

3. 3.

   Story time!

4. 4.

   I’m a user of a web service

5. 5.

   I own resources on the web service

6. 6.

   For example, personal details

7. 7.

   None
8. 8.

   These resources1 are stored on a resource server 2 1.

   personal details 2. facebook.com
9. 9.

   The resource server exposes user resources over an API

10. 10.

    I visit a 3rd party web application

11. 11.

    The 3rd party web app is called a client

12. 12.

    The client1 wants to use my resources2 1. 3rd party

    web app 2. personal details
13. 13.

    But the resource server’s API requires user authorisation

14. 14.

    How?

15. 15.

    Give the client my password

16. 16.

    Give the client my password

17. 17.

    So what then?

18. 18.

    OAuth

19. 19.

    “An open protocol to allow secure API authorisation in a

    simple and standard method from desktop and web applications.” oauth.net
20. 20.

    —˛

21. 21.

    User Client Resources Owns Accesses Authorises

22. 22.

    The flow

23. 23.

    User clicks “sign in” in the client application

24. 24.

    None
25. 25.

    The user is redirected to the resource server and asked

    to sign in
26. 26.

    None
27. 27.

    GET /authorise? response_type=code&client_id=12345&redirect_uri= http://client.tld/ redirect&scope=name,email,birthday HTTP/1.1 Host: resource-server.tld

28. 28.

    The resource server clearly tells the user the specific data

    the client wants to access
29. 29.

    None
30. 30.

    User authorises the application and is redirected back to client

    with a authorisation code in the query string
31. 31.

    HTTP/1.1 302 Found Location: http://client.tld/redirect?code=78dsf9sudfo9s

32. 32.

    Client exchanges the authorisation code for an access token

33. 33.

    POST /token HTTP/1.1 Host: resource-server.tld Content-type: application/x-www-form-urlencoded code=78dsf9sudfo9s&client_id=12345&client_secret =12345&redirect_uri=http://client.tld/redirect

34. 34.

    HTTP/1.1 200 OK Content-type: application/json { access_token: “aLKJHskjhda8s13jsi9sis”, valid_until: 1320759526

    }
35. 35.

    The access token can then be used as authorisation by

    the client to access the specified resources for a specific length of time
36. 36.

    Advantages

37. 37.

    No password sharing <- Happy security conscious user

38. 38.

    Developers just need to implement a redirect and a POST

    request <- Happy developers
39. 39.

    Users can revoke access tokens for specific clients

40. 40.

    None
41. 41.

    Nefarious clients can have their credentials revoked and all associated

    access tokens destroyed immediately
42. 42.

    None
43. 43.

    None
44. 44.

    Currently version 1.0a lncn.eu/giy

45. 45.

    Version 2.0 is almost finished lncn.eu/bkw

46. 46.

    OAuth 2.0 •Simpler •Requires all communication over SSL •New flows

    •Better UX
47. 47.

    Who’s using OAuth?

48. 48.

    None
49. 49.

    And in HE?

50. 50.

    None
51. 51.

    None
52. 52.

    None
53. 53.

    data.lincoln.ac.uk people energy location printing events calendars bibliographic documents

54. 54.

    Internal and external authorisation

55. 55.

    Open source 2.0 server lncn.eu/ar6

56. 56.

    Any questions?

57. 57.

    Thank you @jacksonj04