The Many Layers of OAuth, 2024

Slide 1

Slide 1 text

Product Manager [email protected] The Many Layers of OAuth

Slide 2

Slide 2 text

Agenda - Intro - OAuth Vocabulary - The Grant Types - Which one when? - The fun pain truth lies multitude of specs - Closing / Q&A

Slide 3

Slide 3 text

Who am I?

Slide 4

Slide 4 text

Who am I?

Slide 5

Slide 5 text

Who am I?

Slide 6

Slide 6 text

OAuth Vocab

Slide 7

Slide 7 text

7 7 7 What is OAuth 2.0? It’s unrelated to OAuth 1.0 It’s an authorization framework, has nothing to do with authentication.

Slide 8

Slide 8 text

8 8 8 What is OpenID Connect (OIDC)? It’s unrelated to OpenID It’s an interoperability extension for Single Sign On.

Slide 9

Slide 9 text

9 9 9 Which is better: OAuth or OpenID Connect? Trick question: OIDC is an extension of OAuth

Slide 10

Slide 10 text

10 10 10 Authentication - vs - Authorization

Slide 11

Slide 11 text

Ref: https://datatracker.ietf.org/doc/html/rfc6749

Slide 12

Slide 12 text

12 12 12 Key OAuth Terms - Resource Owner is you - Resource Server is what you want to share access to - Grant Type (aka Flow) describes the use case - Tokens represents the authorization, user, or state - Authorization Server (aka Auth Server) creates the Tokens - Scopes are the permissions you request from the Auth Server - Claims are the key/value pairs returned from the Auth Server

Slide 13

Slide 13 text

13 13 13 Key OAuth Terms (simpliﬁed) - Resource Owner is you - Resource Server where you use the token - Grant Type (aka Flow) how you get the tokens - Tokens are the tokens - Authorization Server (aka Auth Server) creates the Tokens - Scopes how you request stuff in the tokens - Claims the stuff in the tokens

Slide 14

Slide 14 text

14 14 14 Hotel Key Cards but for Apps

Slide 15

Slide 15 text

Grant Types (aka use cases or how you get the tokens)

Slide 16

Slide 16 text

16 16 16 Grant Types (aka OAuth ﬂows) - Authorization Code Flow - Implicit Flow - Resource Owner Password Flow - Client Credential Flow Ref: https://datatracker.ietf.org/doc/html/rfc6749

Slide 17

Slide 17 text

17 17 17 Authorization Code Flow User Auth Client Auth

Slide 18

Slide 18 text

18 18 18 Implicit Flow User Auth No Client Auth!

Slide 19

Slide 19 text

19 19 19 Resource Owner Password Flow Wait. What does that mean? The app has your creds! No Client Auth! User Auth

Slide 20

Slide 20 text

20 20 20 Client Credential Flow Client Auth No User Auth!

Slide 21

Slide 21 text

Which should I use?

Slide 22

Slide 22 text

22 22 22 - Authorization Code Flow - Implicit Flow - Resource Owner Password Flow - Client Credential Flow Grant Types (aka OAuth ﬂows)

Slide 23

Slide 23 text

23 23 23 Which should I use?

Slide 24

Slide 24 text

24 24 24 Grant Types (aka OAuth ﬂows) - Authorization Code Flow - Implicit Flow - Resource Owner Password Flow - Client Credential Flow Extensions - Authorization Code Flow with PKCE - SAML 2.0 Assertion Flow - Device Grant Type - Okta: Interaction Grant Type Ref: Various RFCs

Slide 25

Slide 25 text

25 25 25 Authorization Code Flow with PKCE (RFC 7636) Ref: https://datatracker.ietf.org/doc/rfc7636/ User Auth Client Auth

Slide 26

Slide 26 text

26 26 26 SAML Assertion Flow (RFC 7522) Ref: https://datatracker.ietf.org/doc/rfc7522/ User Auth Client Auth

Slide 27

Slide 27 text

27 27 27 Grant Types (aka OAuth ﬂows) - Authorization Code Flow replaced w/ PKCE (below) - Implicit Flow replaced w/ PKCE (below) - Resource Owner Password Flow removed - Client Credential Flow Extensions - Authorization Code Flow with PKCE - SAML 2.0 Assertion Flow - Device Grant Type - Okta: Interaction Grant Type Ref: https://oauth.net/2.1/ (still a draft)

Slide 28

Slide 28 text

28 28 28 Which should I use?

Slide 29

Slide 29 text

29 29 29 Which should I use? (under OAuth 2.1) * Leaves out SAML Assertion, Device Grant Type, and others Does your App have an end user? Client Credential Flow Auth Code with PKCE Yes No

Slide 30

Slide 30 text

Speciﬁcations

Slide 31

Slide 31 text

Ref: https://datatracker.ietf.org/doc/html/rfc6749 OAuth 2.0 Core (RFC 6749)

Slide 32

Slide 32 text

32 32 32 Notice: NOT Authentication

Slide 33

Slide 33 text

Ref: https://datatracker.ietf.org/doc/html/rfc6749 What are Access Tokens?

Slide 34

Slide 34 text

34 34 34 JWTs to the Rescue! (JSON Web Tokens)

Slide 35

Slide 35 text

35 35 35 Ha. You wish.

Slide 36

Slide 36 text

Ref: https://datatracker.ietf.org/doc/html/rfc7519 JSON Web Token (RFC 7519)

Slide 37

Slide 37 text

Ref: https://datatracker.ietf.org/doc/html/rfc7519 JWTs: Standard Claims!

Slide 38

Slide 38 text

Ref: https://datatracker.ietf.org/doc/html/rfc7519 JWTs: Standard Claims! lol, nope

Slide 39

Slide 39 text

39 39 39 So then what do we do?

Slide 40

Slide 40 text

40 40 40 OpenID Connect FTW

Slide 41

Slide 41 text

Ref: https://openid.net/specs/openid-connect-core-1_0.html OpenID Connect

Slide 42

Slide 42 text

42 42 42 - openid - eroﬁle - email - address - phone OIDC: Opinionated Structure - name - given_name - email - street_address - phone_number And many more..

Slide 43

Slide 43 text

43 43 43 - RFC 7662 Token Introspection - RFC 7009 Token Revocation - RFC 8628 Device Authorization Grant - RFC 7522 SAML Assertion - RFC 7591 Dynamic Client Registration - RFC 7592 Dynamic Client Management - OpenID Connect Metadata Discovery - RFC 8414 Authorization Server Metadata Discovery - Industry-speciﬁc: Open Banking/FAPI, FHIR (healthcare), Open Insurance, Open Energy More Pieces! Ref: https://www.oauth.com/oauth2-servers/map-oauth-2-0-specs/

Slide 44

Slide 44 text

Closing Thoughts

Slide 45

Slide 45 text

45 45 45 “We support OAuth” is a meaningless statement

Slide 46

Slide 46 text

46 46 46 “We support OpenID Connect” is useful (for SSO or interop)

Slide 47

Slide 47 text

47 47 47 Figure out which combination of specs your need & they have *RFC 8414 is your best friend

Slide 48

Slide 48 text

Recap - Intro - OAuth Vocabulary - The Grant Types - Which one when? - The fun pain truth lies multitude of specs - Closing / Q&A

Slide 49

Slide 49 text

Thank You

Slide 50

Slide 50 text

FYI - OAuth 2.0 Simpliﬁed - https://www.oauth.com/ - Includes specs, explanations, etc - OAuth 2.0 Course - Includes examples, walkthroughs, etc

Slide 51

Slide 51 text

Product Manager [email protected] The Many Layers of OAuth