Delegated Access with OAuth

Slide 1

Slide 1 text

Delegated Access with OAuth Why Developers Should Care Annejan Barelds Software Architect DevCampNoord April 4th, 2024

Slide 2

Slide 2 text

Annejan Barelds Software Architect - 4Dotnet Azure – .NET – Architecture – Consultancy https://www.linkedin.com/in/barelds/ https://github.com/AnnejanBarelds

Slide 3

Slide 3 text

Delegated Access OAuth 2.0 On-Behalf-Of

Slide 4

Slide 4 text

2008 Alice Bob Charlie Alice Bob Charlie App ID

Slide 5

Slide 5 text

2016

Slide 6

Slide 6 text

2024

Slide 7

Slide 7 text

App ID Alice Bob Charlie

Slide 8

Slide 8 text

App ID Alice Bob Charlie App ID App ID ? ?

Slide 9

Slide 9 text

No content

Slide 10

Slide 10 text

Office 365 The Need for Zero Trust

Slide 11

Slide 11 text

User Role Group Device Config Location Last Sign-in Conditional access risk Health/Integrity Client Config Last seen High Medium Low Firewall Intrusion Detection/Prevention Forward/Reverse Proxy Source: IP Address/Port Destination: IP Address/Port Signatures Analytics Allow List Authentication Intranet Resources Actions: • Allow • Allow Restricted • Require MFA • Block • Force Remediation Actions: • Allow • Block Device

Slide 12

Slide 12 text

User Role Group Device Config Location Last Sign-in Conditional access risk High Medium Low Intranet Resources Actions: • Allow • Allow Restricted • Require MFA • Block • Force Remediation Actions: • Allow • Block Health/Integrity Client Config Last seen Device Identity Permissions App Identity Permissions API Firewall Intrusion Detection/Prevention Forward/Reverse Proxy Source: IP Address/Port Destination: IP Address/Port Signatures Analytics Allow List Authentication

Slide 13

Slide 13 text

OK, so we need delegated access. How does it work?

Slide 14

Slide 14 text

Resource Server Client IdP Resource Owner Data Scopes: - Read - Write - … Roles: - Owner - Reader App App Required access: - RS/Read AT IT AT SP SP RS/Read openid Consent?

Slide 15

Slide 15 text

AT AT ? Resource Server Client IdP Resource Owner Data Scopes: - Read - Write - … Roles: - Owner - Reader App Required access: - RS/Read IT AT SP SP RS/Read openid IdP App AT API Scopes: - Read Required access: - API/Read Required access: - RS/Read App SP AT AT AT API/Read RS/Read

Slide 16

Slide 16 text

https://www.youtube.com/watch?v=WVNvoiA_ktw John Savill's Technical Training

Slide 17

Slide 17 text

Demo time

Slide 18

Slide 18 text

So it’s all rainbows and unicorns?

Slide 19

Slide 19 text

OAuth On-Behalf-Of is about user context You need user context for - Autonomy - Auditing - Access checks Microsoft Entra ID takes some getting-used-to MSAL solves the coding part

Slide 20

Slide 20 text

Thanks!