Andreas Hucks
@meandmymonkey
• Software Architect at
SensioLabs Deutschland
• Symfony Trainer
Slide 3
Slide 3 text
Authentication
Slide 4
Slide 4 text
No content
Slide 5
Slide 5 text
Knock Knock.
Client Server
Slide 6
Slide 6 text
Who’s there?
Client Server
Slide 7
Slide 7 text
Me.
Client Server
Slide 8
Slide 8 text
kthx.
Client Server
Slide 9
Slide 9 text
HTTP is stateless.
Slide 10
Slide 10 text
Knock Knock.
BTW it's me.
Client Server
Slide 11
Slide 11 text
Not that long ago in a
project not that far away…
Slide 12
Slide 12 text
GET /login?user=myname&pwd=secret
DON'T TRY THIS AT HOME
Slide 13
Slide 13 text
HTTP/1.1 200 OK
Content-‐Type: text/html
[…]
!
1a2b3c4e
DON'T TRY THIS AT HOME
Slide 14
Slide 14 text
GET /profile?ticket=1a2b3c4e
DON'T TRY THIS AT HOME
Slide 15
Slide 15 text
Don’t roll your own.
Slide 16
Slide 16 text
Tokens in the Query String?
It happens.
Slide 17
Slide 17 text
Basic Auth
Slide 18
Slide 18 text
GET /account/ HTTP/1.1
Host: api.localhost
Authorization: Basic aHR0cHdhdGNoOmY=
Slide 19
Slide 19 text
GET /account/ HTTP/1.1
Host: api.localhost
Authorization: Basic aHR0cHdhdGNoOmY=
Slide 20
Slide 20 text
GET /account/ HTTP/1.1
Host: api.localhost
Authorization: Basic aHR0cHdhdGNoOmY=
Slide 21
Slide 21 text
Oh, and use TLS.
Slide 22
Slide 22 text
OAuth2
Slide 23
Slide 23 text
Why?
• Some API providing data under your control
(GitHub, Facebook, Twitter…)
• Third party wants access
• Third party should have limited access to
resource and no access to your credentials
• Centralized Signons
Slide 24
Slide 24 text
How?
• Different flows to grant access
• Suitable for different types of clients
• Result is always a short-lived token that is used
for authentication
– RFC 6750
„A security token with the property that any party in
possession of the token (a "bearer") can use the token in
any way that any other party in possession of it can.
!
Using a bearer token does not require a bearer to prove
possession of cryptographic key material““
Slide 35
Slide 35 text
Oh, and use TLS.
Slide 36
Slide 36 text
MyApp
for
iDroidTM
MyApi
!
!
GET /account
!
Authorization: Bearer
abcd
Slide 37
Slide 37 text
Query String
Post Body
Authorization Header
Intermezzo: Token Location
Slide 38
Slide 38 text
Query String Grmpf.
Post Body Why?
Authorization Header Yep.
Intermezzo: Token Location
Client Key and Secret
7d5ae8a791ce21309e596274e6d69281
5d0d28493bd8bc6c84920200dd88e7d8
53335e65e0624971917d09d376dfdfc9
ae5cf625da962d314515b98753f82193
Slide 72
Slide 72 text
MyApi
!
!
GET /profile
Authorization:
HMAC-‐SHA256
Id=7d5ae8a[…],
Headers=content-‐
type;host;date
Nonce=43hd,
Signature=a688746a[…]
Date: Tue, 14 Aug 2013
13:32:00 GMT
ThatApp
Slide 73
Slide 73 text
Advantages
• Authentication AND protection against
tampering with the request
• Can prevent replay attacks
• No redirects or other extra requests
• In certain circumstances can work without SSL
• RESTful
Slide 74
Slide 74 text
Now this is more difficult
than you would think
Slide 75
Slide 75 text
Canonicalizing a request
• Add HTTP method
• Add URI
• Add query (needs to be canonicalized itself)
• Add headers (sorted and filtered
• Add nonce
• Add Auth information, like Algorithm
Slide 76
Slide 76 text
Signing it
• Derive a key - derivation must be reproducible
by the server
• Create a hash of the canonicalized request
• Use hash and derived key to create signature
using hash_hmac();
Slide 77
Slide 77 text
Don’t roll your own?
Slide 78
Slide 78 text
No content
Slide 79
Slide 79 text
Hash Collisions In AWS V1
?query=yojimbo&limit=5&offset=3
?query=yojimbolimit=5&offset=3&
Slide 80
Slide 80 text
… same result after normalizing:
yojimbolimit5offset3
yojimbolimit5offset3
Slide 81
Slide 81 text
Vendors
• AWS V2, V3, V4
• Windows Azure API
Slide 82
Slide 82 text
HMAC Problems
Slide 83
Slide 83 text
X.509
Client Certificates
Slide 84
Slide 84 text
– me
„the method of which is beyond the
scope of this talk"
Slide 85
Slide 85 text
User and Credentials
Slide 86
Slide 86 text
Wrap up: When to use
what?
Slide 87
Slide 87 text
Sharing Resources
with web or mobile apps
• OAuth2 Authorization Grant
• OAuth2 HMAC extension would be nice, but
• probably not there yet
• ATM, same SDK problems as with pure HMAC
Slide 88
Slide 88 text
Server to Server
• Basic Auth
• HMAC
• OAuth2 Client Credentials
Slide 89
Slide 89 text
Other JS apps
• OAuth2 Implicit Grant
Slide 90
Slide 90 text
Your own JS app
• OAuth2 Implicit Grant or Password Grant
• If you are logged in for the HTML part, re-use the
session (there, I said it)
• Oh yes, SSL
Slide 91
Slide 91 text
Your own Mobile App
• OAuth2 Password Grant
Slide 92
Slide 92 text
Infrastructure or Intranet Level
• X.509 Client Certificates