OAuth2 & OpenID Connect - VNINFO talk

VN-INFO Summer 2019 event.
https://www.facebook.com/groups/244239379100122/

Transcript

1. OAUTH 2.0 & OPENID CONNECT VN-INFO SUMMER 2019
2. OUTLINE ▸ OAuth 2.0 ▸ Context ▸ Code flow ▸ Implicit flow ▸ Future ▸ OpenID Connect (OIDC) ▸ A bit of history ▸ OpenID Connect vs OAuth
3. OAUTH CONTEXT BEFORE OAUTH
4. OAUTH CONTEXT BEFORE OAUTH
6. OAUTH TO THE RESCUE!
8. NOWADAYS SOCIAL LOGIN BUTTONS
9. ▸ Complex terminology, WTF is resource owner, authorization grant? ▸ Too much incorrect resources ▸ Too many versions
10. FLOW (USE CASE) ▸ Backend: code flow ▸ Front-end only, Native app: implicit flow ▸ User password: support old app ▸ Client credential: backend to backend call
11. FLOW (USE CASE) ▸ Backend: code flow ▸ Front-end only, Native app: implicit flow ▸ User password: support old app ▸ Client credential: backend to backend call
12. User App: Contact Manager Identity Provider: Facebook 1) User goes to an app, clicks on 2) User redirected to Facebook, accept sharing data with app 3) App receives "Grant", exchange for having user contacts 4) Contact import successful! FLOW
13. 1) User goes to an app, clicks on 2) User redirected to Facebook, accept sharing data with app 3) App receives "Grant", exchange for having user contacts 4) Contact import successful! CODE FLOW facebook.com/oauth?response_type=code& client_id=1234& redirect_uri=http://app/callback scope=email& state=random_string http://app/callback?code=secret_code facebook.com/token?code=secret_code access_token facebook.com/contacts?access_token=access_token [ { name: "first last", email: "abcd@gmail.com" }, { name: "John Wick", email: "john@wick.com" } ] BACKEND TO BACKEND INSIDE BROWSER User App: Contact Manager Identity Provider: Facebook
14. User App Identity Provider 1) User goes to an app, clicks on 2) User redirected to Facebook, accept sharing data with app 3) App receives "Access Token", exchange for having user contacts 4) Contact import successful! IMPLICIT FLOW facebook.com/oauth?response_type=token& client_id=1234& redirect_uri=http://app/callback scope=email& state=random_string http://app/callback?access_token=secret facebook.com/contacts?access_token=access_token [ { name: "first last", email: "abcd@gmail.com" }, { name: "John Wick", email: "john@wick.com" } ] INSIDE BROWSER
15. FUTURE ▸ Backend: code flow ▸ Front-end only, Native app: implicit flow ▸ User password: support old app ▸ Client credential: backend to backend call PKCE CODE FLOW
16. what's wrong with oauth2? AUTHORIZATION != AUTHENTICATION
17. TEXT USING OAUTH FOR AUTHENTICATION IS A HACK ▸ No standard to get user info ▸ Different implementation
19. ID TOKEN - JWT
20. User App Identity Provider 1) User goes to an app, clicks on 2) User redirected to Facebook, accept sharing data with app 3) App receives "Code", exchange for having user information: email, name, ... 4) User is logged in OPENID CONNECT CODE FLOW facebook.com/oauth?response_type=code& client_id=1234& redirect_uri=http://app/callback scope=email& state=random_string http://app/callback?code=secret_code facebook.co/token?code=secret_code ID_TOKEN BACKEND TO BACKEND INSIDE BROWSER
21. User App Identity Provider 1) User goes to an app, clicks on 2) User redirected to Facebook, accept sharing data with app 3) App receives "Access Token" and "ID Token", exchange for having user information: email, name, ... 4) User is logged in OPENID CONNECT IMPLICIT FLOW facebook.com/oauth?response_type=code& client_id=1234& redirect_uri=http://app/callback scope=email& state=random_string http://app/callback?access_token=secret&id_token=jwt INSIDE BROWSER
22. OPENID IS FOR HUMANS LOGGING INTO MACHINES, OAUTH IS FOR MACHINES LOGGING INTO MACHINES ON BEHALF OF HUMANS. whoami
23. DEMO TIME
24. THANKS!