OAuth démystifié ! Sébastien Stormacq, AWS Developer Advocate @sebsto

Congrats ! Your app launched !" # $ % &

No content

userid firstname lastmail email password sebsto Sébastien Stormacq [email protected] FA34BD7543E… natalia Natalia Arbelaez [email protected] AA6FC2984AB…

What possibly can go wrong ? '()

From 50 to 50.000.000 users *+,*+,*+,*+,*+,*+,*+,

http://blog.interactiveschools.com/blog/50-million-users-how-long-does-it-take-tech-to-reach-this-milestone

No content

No content

No content

No content

[email protected]

No content

No content

Developers build features !"#

DO NOT ⛔ Build your own identity system Store user credentials

Identification Authentication Authorisation

OAuth OpenID Connect

Managed OAuth Service

Amazon Cognito Managed identities in the ☁ Managed user directory Signin with existing identities (federation) Customised hosted UI or SDK AWS credentials and access control OpenID Connect and Oauth 2

Amazon Cognito Managed identities in the ☁

OpenID Connect and OAuth Flows

Implicit Grant

User User Client App (browser, mobile app, app server) Auth Service Authorization & Identity Server Resource Server (API) Client App (browser, mobile app, app server) Auth Service Authorization & Identity Server Resource Server (API) authenticate click login with XXX. ? state = 987 & redirect_uri = auth Service & client_id = 123 & scope = email & response = token enter credentials verify credentials redirect to redirect_uri ? state = 987 & token = abc & token_type = bearer access API get access token Invoke API (authorization : access_token) securely store token

Code Grant

User User Client App (browser, mobile app, app server) Auth Service Authorization & Identity Server Resource Server (API) Client App (browser, mobile app, app server) Auth Service Authorization & Identity Server Resource Server (API) authenticate click login with XXX. ? state = 987 & redirect_uri = auth Service & client_id = 123 & scope = email & response = code enter credentials verify credentials redirect to redirect_uri ? code = abc & state = 987 get_token ? client_id = 123 & code = abc (authorization = base64(client_id:client-secret ) return id, access & refresh tokens securely store tokens access API get access token Invoke API (authorization : access_token) (optional) refresh tokens

Demo

Thank you ! @sebsto /sebsto /sebsto /sebAWS Sébastien Stormacq