Demystifying OAuth and OIDC An illustrated crash course Deepu K Sasidharan

@auth0 | @deepu105 | deepu.tech ➔ JHipster co-chair ➔ Java Champion ➔ Creator of KDash, JDL Studio, JWT UI ➔ Developer Advocate @ Okta ➔ OSS aficionado, polyglot dev, author, speaker Hi, I’m Deepu K Sasidharan @deepu105@mastodon.social deepu.tech @deepu105.bsky.social deepu05

@auth0 | @deepu105 | deepu.tech Authorization Process of determining whether a user has the necessary permissions to access a resource.

@auth0 | @deepu105 | deepu.tech OAuth OAuth is the industry-standard protocol for delegated authorization.

@auth0 | @deepu105 | deepu.tech Why OAuth?

@auth0 | @deepu105 | deepu.tech Enhanced security: Token based, Limited Scope & Duration Standardized: Interoperability, ease of integration Flexible & Scalable: Diverse use cases, cross platform UX: Widely adopted, good UX, social login

@auth0 | @deepu105 | deepu.tech OAuth OAuth 1.0 →No longer used OAuth 2.0 →Widely used version OAuth 2.1 →Latest version

@auth0 | @deepu105 | deepu.tech System Roles

@auth0 | @deepu105 | deepu.tech Tokens Access Token →Authorization to access a resource Authorization Code →Short lived token to get an access token Refresh Token →Long lived token to get new access tokens

@auth0 | @deepu105 | deepu.tech Claim →KV pair assertion with user info Scope →Group of claims or permission limiting access

@auth0 | @deepu105 | deepu.tech OAuth 2.0 Grants Authorization Code Grant →Exchange authorization code for access token (secure clients) Implicit Grant →Get access token directly (SPA, native apps) Client Credentials Grant →Access token without user interaction (confidential clients) Resource Owner Password Credentials Grant →Access token using user credentials (trusted clients)

@auth0 | @deepu105 | deepu.tech OAuth 2.1 Grants Authorization Code Grant with PKCE →Exchange authorization code for access token (secure clients, SPAs, native apps) Client Credentials Grant →Access token without user interaction (confidential clients)

@auth0 | @deepu105 | deepu.tech Other Grants Refresh Token Grant→Exchange refresh token for access token Extension Grants →Device Authorization Grant, Token Exchange Grant, CIBA, etc.

@auth0 | @deepu105 | deepu.tech OAuth 2 Flows

@auth0 | @deepu105 | deepu.tech Implicit Grant Flow (Not recommended) Authorization request { client_id, response_type=token, redirect_uri=..., scope, state, etc } Token request NA

@auth0 | @deepu105 | deepu.tech Resource Owner Password Credentials Grant Flow (Not recommended) Authorization request NA Token request { client_id, client_secret, username, password, grant_type=password }

@auth0 | @deepu105 | deepu.tech Authorization Code Grant Flow (Not recommended) Authorization request { client_id, response_type=code, redirect_uri=..., scope, state, etc } Token request { client_id, client_secret, authorization_code, grant_type=authorization_code, redirect_uri, etc }

@auth0 | @deepu105 | deepu.tech Authorization Code Grant Flow with PKCE Authorization request { client_id, response_type=code, redirect_uri=..., code_challenge, scope, state, etc, } Token request { client_id, code_verifier, authorization_code, grant_type=authorization_code, redirect_uri, etc }

@auth0 | @deepu105 | deepu.tech Client Credentials Grant Flow Authorization request NA Token request { client_id, client_secret, grant_type=client_credentials }

@auth0 | @deepu105 | deepu.tech Refresh Token Grant Flow Authorization request NA Token request { client_id, client_secret, refresh_token, grant_type=refresh_token }

@auth0 | @deepu105 | deepu.tech Device Authorization Grant Flow Device Authorization request { client_id, scope, } Token request { client_id, device_code, grant_type=urn:ietf:params :oauth:grant-type:device_code }

@auth0 | @deepu105 | deepu.tech OAuth Flow Decision Tree

@auth0 | @deepu105 | deepu.tech Authentication Process of verifying the identity of a user. OAuth lacked a standard way to authenticate users.

@auth0 | @deepu105 | deepu.tech OpenID Connect OpenID Connect (OIDC) is an identity layer built on top of the OAuth 2.0 framework

@auth0 | @deepu105 | deepu.tech OIDC using Authorization Code Grant Flow with PKCE Authorization request { client_id, response_type=code, redirect_uri=..., code_challenge, scope=’openid,..’, state, etc, } Token request { client_id, code_verifier, authorization_code, grant_type=authorization_code, redirect_uri, etc }

@auth0 | @deepu105 | deepu.tech Auth for GenAI Try the demo and join the waitlist JWT UI

@auth0 | @deepu105 | deepu.tech You are now an OAuth expert!

@auth0 | @deepu105 | deepu.tech Auth for GenAI Try the demo and join the waitlist

@auth0 | @deepu105 | deepu.tech OAuth2 and OIDC workshop for Java Developers

@auth0 | @deepu105 | deepu.tech Thank You