Demystifying OAuth and OIDC An illustrated crash course Deepu K Sasidharan

@oktaDev | @deepu105 | deepu.tech ➔ JHipster co-chair ➔ Java Champion ➔ Creator of KDash, JDL Studio, JWT UI ➔ Developer Advocate @ Okta ➔ OSS aficionado, polyglot dev, author, speaker Hi, I’m Deepu K Sasidharan @[email protected] deepu.tech @deepu105 deepu05

@oktaDev | @deepu105 | deepu.tech Authorization Process of determining whether a user has the necessary permissions to access a resource.

@oktaDev | @deepu105 | deepu.tech OAuth OAuth is the industry-standard protocol for delegated authorization.

@oktaDev | @deepu105 | deepu.tech OAuth OAuth 1.0 →No longer used OAuth 2.0 →Widely used version OAuth 2.1 →Latest version

@oktaDev | @deepu105 | deepu.tech System Roles Resource Owner →End user Resource Server →API Server Client →System requesting access Authorization Server →Authenticate and issue tokens

@oktaDev | @deepu105 | deepu.tech System Roles

@oktaDev | @deepu105 | deepu.tech Tokens Access Token →Authorization to access a resource Authorization Code →Short lived token to get an access token Refresh Token →Long lived token to get new access tokens

@oktaDev | @deepu105 | deepu.tech Claim →KV pair assertion with user info Scope →Group of claims or permission limiting access

@oktaDev | @deepu105 | deepu.tech OAuth 2.0 Grants Authorization Code Grant →Exchange authorization code for access token (secure clients) Implicit Grant →Get access token directly (SPA, native apps) Client Credentials Grant →Access token without user interaction (confidential clients) Resource Owner Password Credentials Grant →Access token using user credentials (trusted clients)

@oktaDev | @deepu105 | deepu.tech Authorization Code Grant →Exchange authorization code for access token (secure clients) Authorization Code Grant with PKCE →Exchange authorization code for access token (secure clients, SPAs, native apps) OAuth 2.0 Grants OAuth 2.1 Grants Implicit Grant →Get access token directly (SPA, native apps) Implicit Grant →Get access token directly (SPA, native apps) Client Credentials Grant →Access token without user interaction (confidential clients) Resource Owner Password Credentials Grant →Access token using user credentials (trusted clients) Resource Owner Password Credentials Grant →Access token using user credentials (trusted clients)

@oktaDev | @deepu105 | deepu.tech OAuth 2.1 Grants Authorization Code Grant with PKCE →Exchange authorization code for access token (secure clients, SPAs, native apps) Client Credentials Grant →Access token without user interaction (confidential clients)

@oktaDev | @deepu105 | deepu.tech Other Grants Refresh Token Grant→Exchange refresh token for access token Extension Grants →Device Authorization Grant, Token Exchange Grant, etc.

@oktaDev | @deepu105 | deepu.tech OAuth 2 Flows

@oktaDev | @deepu105 | deepu.tech Implicit Grant Flow (Not recommended) Authorization request { client_id, response_type=token, redirect_uri=..., scope, state, etc } Token request NA

@oktaDev | @deepu105 | deepu.tech Resource Owner Password Credentials Grant Flow (Not recommended) Authorization request NA Token request { client_id, client_secret, username, password, grant_type=password }

@oktaDev | @deepu105 | deepu.tech Authorization Code Grant Flow (Not recommended) Authorization request { client_id, response_type=code, redirect_uri=..., scope, state, etc } Token request { client_id, client_secret, authorization_code, grant_type=authorization_code, redirect_uri, etc }

@oktaDev | @deepu105 | deepu.tech Authorization Code Grant Flow with PKCE Authorization request { client_id, response_type=code, redirect_uri=..., code_challenge, scope, state, etc, } Token request { client_id, code_verifier, authorization_code, grant_type=authorization_code, redirect_uri, etc }

@oktaDev | @deepu105 | deepu.tech Client Credentials Grant Flow Authorization request NA Token request { client_id, client_secret, grant_type=client_credentials }

@oktaDev | @deepu105 | deepu.tech Refresh Token Grant Flow Authorization request NA Token request { client_id, client_secret, refresh_token, grant_type=refresh_token }

@oktaDev | @deepu105 | deepu.tech Device Authorization Grant Flow Device Authorization request { client_id, scope, } Token request { client_id, device_code, grant_type=urn:ietf:params :oauth:grant-type:device_code }

@oktaDev | @deepu105 | deepu.tech Authentication Process of verifying the identity of a user. OAuth lacked a standard way to authenticate users.

@oktaDev | @deepu105 | deepu.tech OpenID Connect OpenID Connect (OIDC) is an identity layer built on top of the OAuth 2.0 framework

@oktaDev | @deepu105 | deepu.tech OIDC using Authorization Code Grant Flow with PKCE Authorization request { client_id, response_type=code, redirect_uri=..., code_challenge, scope=’openid,..’, state, etc, } Token request { client_id, code_verifier, authorization_code, grant_type=authorization_code, redirect_uri, etc }

@oktaDev | @deepu105 | deepu.tech You are now an OAuth expert!

@oktaDev | @deepu105 | deepu.tech OAuth2 and OIDC workshop for Java Developers

© Okta and/or its affiliates. All rights reserved. For Okta internal use only. DATA CLASSIFICATION: OKTA INTERNAL dev_day a 24 hour virtual event September 24, 2024 Registration opens summer of 2024 Stay up to date with the latest at: a0.to/devday

@oktaDev | @deepu105 | deepu.tech Thank You Subscribe to our newsletter a0.to/nl-signup/java Try our free Spring Boot + Passkeys workshop a0.to/spring-boot