OAuth2, OIDC & JWT - Important Basics!

Slide 1

Slide 1 text

OAUTH2, OIDC & JWT

Slide 2

Slide 2 text

Niko Köbler | keycloak-experte.de Keycloak IAM & SSO ABOUT ME ▸ Independent Consultant/Architect/Developer/Trainer ▸ Doing stuff with & without Computers, Software, > 25 yrs ▸ "Mr. Keycloak" > 9 yrs (since 1.x) ▸ Co-Lead of JUG DA (https://www.jug-da.de / @JUG_DA) ▸ Author of „Serverless Computing in AWS Cloud“ serverlessbuch.de ▸ Web: www.n-k.de / Social: @dasniko ▸ YouTube: youtube.com/@dasniko

Slide 3

Slide 3 text

No content

Slide 4

Slide 4 text

OAuth 2.0 OIDC JWT

Slide 5

Slide 5 text

AUTHORIZATION AUTHENTICATION

Slide 6

Slide 6 text

No content

Slide 7

Slide 7 text

No content

Slide 8

Slide 8 text

OAuth 2.0 AUTHORIZATION, NOT AUTHENTICATION! IETF, RFC 6749, 2012 The OAuth 2.0 authorization framework enables a 3rd-party application to obtain limited access to an HTTP service.

Slide 9

Slide 9 text

OAuth 2.0 Grant Types GRANT TYPE APPS Authorization Code (+PKCE!) Web, Apps Implicit JavaScript, etc. Resource Owner Password Credentials Apps Client Credentials Web Refresh Web, Apps

Slide 10

Slide 10 text

User (Resource Owner) Code Veriﬁer ABC123 Application (Client) Login Code Challenge e0bebd22… SHA256 Hash Identity Provider (Authorization Server) HTTP Redirect with Code Challenge & Code Challenge Method Application (Client) HTTP Redirect with Authorization Code HTTP Response with Access Token HTTP POST with Authorization Code and Code Veriﬁer Code Challenge Comparison PROOF KEY FOR CODE EXCHANGE PKCE

Slide 11

Slide 11 text

OAuth 2.1 IETF, OAUTH 2.1 DRAFT ‣ PKCE is required for all clients using the authz code ﬂow ‣ Redirect URIs must be compared using exact string matching ‣ The Implicit grant is omitted from this speciﬁcation ‣ The Resource Owner Password Credentials grant is omitted from this specification

Slide 12

Slide 12 text

ACCESS TOKEN { "access_token": "6041a9d7-8c39-4945-b7c6-eaf7bd5d0907", "token_type": "Bearer", "expires_in": 3600, "refresh_token": "e339b569-6d95-482d-9534-5c0147136ab0", "refresh_expires_in": 36000 }

Slide 13

Slide 13 text

OPEN ID CONNECT Authentication Layer on top of OAuth 2.0 ‣ verify the identity of an end-user ‣ obtain basic proﬁle information about the user ‣ RESTful HTTP API, using JSON as data format ‣ allows clients of all types (web-based, mobile, JavaScript) OpenID Foundation, 2014

Slide 14

Slide 14 text

SCOPE: OPENID Authorization Server becomes Identity Provider

Slide 15

Slide 15 text

SCOPES In OAuth2, scopes deﬁne on which data a 3rd party service has which access to. Scope values are not deﬁned.

Slide 16

Slide 16 text

SCOPES In OIDC scopes are deﬁned: openid, profile, email, address, phone, offline_access Scopes deﬁne which user-related data a client can obtain from the IdP

Slide 17

Slide 17 text

OIDC { "access_token": "6041a9d7-8c39-4945-b7c6-eaf7bd5d0907", "token_type": "Bearer", "expires_in": 3600, "id_token": "???", "refresh_token": "e339b569-6d95-482d-9534-5c0147136ab0", "refresh_expires_in": 36000 } OpenID Connect adds the IDentity Token

Slide 18

Slide 18 text

JWT JSON Web Token IETF, RFC 7519 Standard, 2015

Slide 19

Slide 19 text

JWT eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImQyMD M2MGU4LTgyOTUtNDlhNy1iOGQzLTMxOWU3MWI2OD k4MiJ9.eyJqdGkiOiJhYzMwYWM3Ni00NTQ5LTRiMWMtO TQwYi1hMGNjNjU1NTNkM2YiLCJpc3MiOiJodHRwOi8va2 V5Y2xvYWsuZGUiLCJzdWIiOiIxMjM0NTY3ODkwIiwibmF tZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.H6T 2YmhH-7nsp3zUu9XE7Cs-62J6D38KsXcIO6ZmxDikJ… Base64 encoded

Slide 20

Slide 20 text

JSON Web Token

Slide 21

Slide 21 text

JWT PAYLOAD { "jti": "b7f7b763-240c-4560-827b-d7635e4b2213", "sub": "c7bd0190-7fbd-42bd-8929-63f2a17473fb", "iss": "https://sso.myapi.com", "aud": "myApi", "exp": 1686767014, "iat": 1686763414, "nbf": 1686763414 } RESERVED CLAIMS: jti, sub, iss, aud, exp, iat, nbf

Slide 22

Slide 22 text

OpenID Connect Standard Claims http://openid.net/specs/openid-connect-core-1_0.html

Slide 23

Slide 23 text

TOKEN RESPONSE { "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...", "token_type": "Bearer", "expires_in": 3600, "id_token": "eyJhbGciOiAiUlMyNTYiLCJ0eXAiOiAiSldUIn0...", "refresh_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...", "refresh_expires_in": 36000 }

Slide 24

Slide 24 text

OIDC OpenID Connect adds the USERINFO Endpoint

Slide 25

Slide 25 text

THANK YOU. ANY QUESTIONS? Slides: https://speakerdeck.com/dasniko NIKO KÖBLER | www.n-k.de | [email protected] | @dasniko OAUTH2, OIDC & JWT

Slide 26

Slide 26 text

BACKUP

Slide 27

Slide 27 text

PEP 1. View Record #123 6. View Record #123 PDP 2. Can user view record #123? 3. Evaluate Policies PAP Manage Policies PIP 4. Retrieve additional attributes 5. Permit, user can view record #123 AuthZ: PAP / PDP / PEP / PIP