![Secure Arch: APIs Authorization
eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2
lkIiA6ICJ5WmNnMzF3YzMtRGwwcGttNk5adF
Q0NmdjU3ZWeGVJdWN4UkNhWVBYaDVvIn
0.eyJqdGkiOiJlMDQwNjJjOC1jY2MwLTQzN2It
YTIyMC1iMzRkOWExOGQ0MTUiLCJleHAiOj
E1MDQzMjc0NDcsIm5iZiI6MCwiaWF0IjoxNTA
0MzI3MTQ3LCJpc3MiOiJodHRwOi8vMTkyLjE
2OC4xMjIuMTo4MDgwL2F1dGgvcmVhbG1zL
3BocC1zdW1taXQiLCJhdWQiOiJmcm9udGVu
ZGFwcCIsInN1YiI6IjFlYzUwNDg3LTg5Y2QtN
GYyNS1iODRmLTVkYTU0M2U3NmYxOSIsIn
R5cCI6IkJlYXJlciIsImF6cCI6ImZyb250ZW5kY
XBwIiwiYXV0aF90aW1lIjowLCJzZXNzaW9uX
3N0YXRlIjoiN2EyNDkyOWUtZTUwYy00Yzk1L
Tk1YmItNWQ3MDE2ZDQ5MWU1IiwiYWNyIjoi
MSIsImFsbG93ZWQtb3JpZ2lucyI6WyJodHRw
Oi8vbG9jYWxob3N0Il0sInJlYWxtX2FjY2VzcyI
6eyJyb2xlcyI6WyJST0xFX0dPRCIsInVtYV9hd
XRob3JpemF0aW9uIl19LCJyZXNvdXJjZV9hY
2Nlc3MiOnsiYWNjb3VudCI6eyJyb2xlcyI6WyJt
YW5hZ2UtYWNjb3VudCIsIm1hbmFnZS1hY2N
vdW50LWxpbmtzIiwidmlldy1wcm9maWxlIl19fS
wibmFtZSI6IkVyaWNrIEJlbGx1Y2kgVGVkZXN
jaGkiLCJwcmVmZXJyZWRfdXNlcm5hbWUiOi
JlcmljayIsImdpdmVuX25hbWUiOiJFcmljayIsIm
ZhbWlseV9uYW1lIjoiQmVsbHVjaSBUZWRlc2
NoaSIsImVtYWlsIjoiZXJpY2tAb2VyaWNrLmNv
bSJ9.KCPOmXVvkGMZxMztDbj662IK61Sma
Wx9lfOYktTcVM9oWzLfl5y4IW6tGpWZTxcTDl
3AViyuV8MN0PSNy2hIpjpOR404-9pQCOfE-
MRF_nIOErNbq_FUOz7d6Jfh-
QceCPaBzhxsKWYBNuIOS22grdwooo1vwDj_
KKLB1d92P7MAy0hRK0...
{
"alg":"RS256",
"typ" : "JWT",
"kid" : "yZcg31wc3-Dl0pkm6NZtT46gcSvVxeIucxRCaYPXh5o"
}
{
"jti":"e04062c8-ccc0-437b-a220-b34d9a18d415",
"exp":1504327447,
"nbf":0,
"iat":1504327147,
"iss":"http://192.168.122.1:8080/auth/realms/roadsex",
"aud":"frontendapp",
"sub":"1ec50487-89cd-4f25-b84f-5da543e76f19",
"typ":"Bearer",
"azp":"frontendapp",
"auth_time":0,
"session_state":"7a24929e-e50c-4c95-95bb-5d7016d491e5",
"acr":"1",
"allowed-origins":["http://localhost"],
"realm_access":{"roles":["ROLE_GOD","uma_authorization"]},
"resource_access":{"account":{"roles":["view-profile"]}},
"name":"Erick Belluci Tedeschi",
"preferred_username":"erick",
"given_name":"Erick",
"family_name":"Belluci Tedeschi",
"email":"erick@oerick.com"
}
JWS Signature (signed with the private key)](https://image.slidesharecdn.com/2017-11roadsecapisauthorization-171114115016/85/RoadSec-2017-Trilha-AppSec-APIs-Authorization-11-320.jpg)
![Secure Arch: APIs Authorization
How an access_token
(authorization) looks like?
// JWT Payload
{
"sub": "alice", // user id
"cid": "000123", // client id
"iss": "https://as.domain.com", // who issued
"aud": "https://rs.domain.com",
"exp": 1460345736, // expiration date
"scp": ["openid","email","profile"] // scopes
}](https://image.slidesharecdn.com/2017-11roadsecapisauthorization-171114115016/85/RoadSec-2017-Trilha-AppSec-APIs-Authorization-15-320.jpg)
![Secure Arch: APIs Authorization
How an id_token looks like?
// JWT Payload// JWT Payload
{{
"iss": ”InstIdentRicardoGumbletonDaunt", // who issued
"sub": ”4.444.444", // user identification
"aud": ["cops","bank"], // where it’s used
"nonce": "n-0S6_WzA2Mj",
"exp": 1311281970, // 10 years
"iat": 1311280970,
"auth_time": 1311280969,
"amr": "sign+fingerprint” //auth-methods-ref
}](https://image.slidesharecdn.com/2017-11roadsecapisauthorization-171114115016/85/RoadSec-2017-Trilha-AppSec-APIs-Authorization-17-320.jpg)
RoadSec 2017 - Trilha AppSec - APIs Authorization
- 1. Secure Architecture: APIs Authorization Erick Belluci Tedeschi @ericktedeschi O MAIOR FESTIVAL HACKER DA AMÉRICA LATINA
- 2. Secure Arch: APIs Authorization $ whoami ● Web Developer since 2003Web Developer since 2003 ● Application Security since 2007Application Security since 2007 ● BikerBiker ● MakerMaker
- 3. Secure Arch: APIs Authorization Agenda ● Auth Basic (recap) ● Hypothetical case ● Oauth,OpenID Connect,JWT (what?) ● Keycloak to rule them all ● Demo
- 4. Secure Arch: APIs Authorization Auth Basic (recap) ● RFC7617 (obsolete RFC2617)RFC7617 (obsolete RFC2617) ● Easy to implement and understandEasy to implement and understand ● It’s an “Authentication” standardIt’s an “Authentication” standard ● Stateless (the credentials are sent atStateless (the credentials are sent at every request in the same context)every request in the same context)
- 5. Secure Arch: APIs Authorization Auth Basic (recap)
- 6. Secure Arch: APIs Authorization Hypothetical case Account Service GET /my/{user_id} Transfer Service POST /transfer/{src_account}/{dst_acocunt} Receipt Service GET /receipts/{user_id} Your cloud or data center environment Resource Owner Mobile Browser Basic auth Basic auth No auth Fintech API GET /my POST /transfer/{dst_account} GET /receipts Minimum needed /token /authorize
- 7. Secure Arch: APIs Authorization Account Service GET /my/{user_id} Transfer Service POST /transfer/{src_account}/{dst_acocunt} Receipt Service GET /receipts/{user_id} Your cloud or data center environment End-User Mobile Browser Basic auth Basic auth No auth Fintech API GET /my POST /transfer/{dst_account} GET /receipts ● Poor logging (audit trail) ● Poor identification/accountability on microservices (X-User-Logged ??) ● Authorization centralized on API Gateway ● Microservices have “micro user repositories” or don’t have authentication/authorization ● API Gateway have more responsibility than necessary ● Basic knowledge of patterns ● Poor logging (audit trail) ● Poor identification/accountability on microservices (X-User-Logged ??) ● Authorization centralized on API Gateway ● Microservices have “micro user repositories” or don’t have authentication/authorization ● API Gateway have more responsibility than necessary ● Basic knowledge of patterns Minimum needed /token /authorize Hypothetical case
- 8. Secure Arch: APIs Authorization Let’s improve it…
- 9. Secure Arch: APIs Authorization JOSÉ JavaScript Object Signing and EncryptionJavaScript Object Signing and Encryption JWT JSON Web Token JWA JSON Web Algorithms JWK JSON Web Key JWA JSON Web Algorithms JWS JSON Web Signature JWA JSON Web Algorithms JWE JSON Web Encryption integrityintegrity confidentialityconfidentiality
- 10. Secure Arch: APIs Authorization JWT JSON Web Token JWA JSON Web Algorithms JWK JSON Web Key JWA JSON Web Algorithms JWS JSON Web Signature JWA JSON Web Algorithms JWE JSON Web Encryption integrityintegrity confidentialityconfidentiality JOSÉ JavaScript Object Signing and EncryptionJavaScript Object Signing and Encryption ✔ URL-SafeURL-Safe ✔ Intended for space constrained environmentsIntended for space constrained environments ✔ HTTP Headers (like Authorization)HTTP Headers (like Authorization) ✔ URI Query ParametersURI Query Parameters ✔ FlexibleFlexible ✔ InteroperableInteroperable
- 11. Secure Arch: APIs Authorization eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2 lkIiA6ICJ5WmNnMzF3YzMtRGwwcGttNk5adF Q0NmdjU3ZWeGVJdWN4UkNhWVBYaDVvIn 0.eyJqdGkiOiJlMDQwNjJjOC1jY2MwLTQzN2It YTIyMC1iMzRkOWExOGQ0MTUiLCJleHAiOj E1MDQzMjc0NDcsIm5iZiI6MCwiaWF0IjoxNTA 0MzI3MTQ3LCJpc3MiOiJodHRwOi8vMTkyLjE 2OC4xMjIuMTo4MDgwL2F1dGgvcmVhbG1zL 3BocC1zdW1taXQiLCJhdWQiOiJmcm9udGVu ZGFwcCIsInN1YiI6IjFlYzUwNDg3LTg5Y2QtN GYyNS1iODRmLTVkYTU0M2U3NmYxOSIsIn R5cCI6IkJlYXJlciIsImF6cCI6ImZyb250ZW5kY XBwIiwiYXV0aF90aW1lIjowLCJzZXNzaW9uX 3N0YXRlIjoiN2EyNDkyOWUtZTUwYy00Yzk1L Tk1YmItNWQ3MDE2ZDQ5MWU1IiwiYWNyIjoi MSIsImFsbG93ZWQtb3JpZ2lucyI6WyJodHRw Oi8vbG9jYWxob3N0Il0sInJlYWxtX2FjY2VzcyI 6eyJyb2xlcyI6WyJST0xFX0dPRCIsInVtYV9hd XRob3JpemF0aW9uIl19LCJyZXNvdXJjZV9hY 2Nlc3MiOnsiYWNjb3VudCI6eyJyb2xlcyI6WyJt YW5hZ2UtYWNjb3VudCIsIm1hbmFnZS1hY2N vdW50LWxpbmtzIiwidmlldy1wcm9maWxlIl19fS wibmFtZSI6IkVyaWNrIEJlbGx1Y2kgVGVkZXN jaGkiLCJwcmVmZXJyZWRfdXNlcm5hbWUiOi JlcmljayIsImdpdmVuX25hbWUiOiJFcmljayIsIm ZhbWlseV9uYW1lIjoiQmVsbHVjaSBUZWRlc2 NoaSIsImVtYWlsIjoiZXJpY2tAb2VyaWNrLmNv bSJ9.KCPOmXVvkGMZxMztDbj662IK61Sma Wx9lfOYktTcVM9oWzLfl5y4IW6tGpWZTxcTDl 3AViyuV8MN0PSNy2hIpjpOR404-9pQCOfE- MRF_nIOErNbq_FUOz7d6Jfh- QceCPaBzhxsKWYBNuIOS22grdwooo1vwDj_ KKLB1d92P7MAy0hRK0... { "alg":"RS256", "typ" : "JWT", "kid" : "yZcg31wc3-Dl0pkm6NZtT46gcSvVxeIucxRCaYPXh5o" } { "jti":"e04062c8-ccc0-437b-a220-b34d9a18d415", "exp":1504327447, "nbf":0, "iat":1504327147, "iss":"http://192.168.122.1:8080/auth/realms/roadsex", "aud":"frontendapp", "sub":"1ec50487-89cd-4f25-b84f-5da543e76f19", "typ":"Bearer", "azp":"frontendapp", "auth_time":0, "session_state":"7a24929e-e50c-4c95-95bb-5d7016d491e5", "acr":"1", "allowed-origins":["http://localhost"], "realm_access":{"roles":["ROLE_GOD","uma_authorization"]}, "resource_access":{"account":{"roles":["view-profile"]}}, "name":"Erick Belluci Tedeschi", "preferred_username":"erick", "given_name":"Erick", "family_name":"Belluci Tedeschi", "email":"erick@oerick.com" } JWS Signature (signed with the private key)
- 12. Secure Arch: APIs Authorization The Oauth 2.0 Authorization Framework The Oauth 2.0 enables a third-party applicationThe Oauth 2.0 enables a third-party application to obtain limited access to an HTTP service onto obtain limited access to an HTTP service on behalf of a resource owner...behalf of a resource owner...
- 13. Secure Arch: APIs Authorization Warning! Oauth is not about authentication
- 14. Secure Arch: APIs Authorization Warning! Oauth is not about authentication
- 15. Secure Arch: APIs Authorization How an access_token (authorization) looks like? // JWT Payload { "sub": "alice", // user id "cid": "000123", // client id "iss": "https://as.domain.com", // who issued "aud": "https://rs.domain.com", "exp": 1460345736, // expiration date "scp": ["openid","email","profile"] // scopes }
- 16. Secure Arch: APIs Authorization OpenID Connect OpenID Connect 1.0 is a “simple” identity layerOpenID Connect 1.0 is a “simple” identity layer on top of OAuth 2.on top of OAuth 2.
- 17. Secure Arch: APIs Authorization How an id_token looks like? // JWT Payload// JWT Payload {{ "iss": ”InstIdentRicardoGumbletonDaunt", // who issued "sub": ”4.444.444", // user identification "aud": ["cops","bank"], // where it’s used "nonce": "n-0S6_WzA2Mj", "exp": 1311281970, // 10 years "iat": 1311280970, "auth_time": 1311280969, "amr": "sign+fingerprint” //auth-methods-ref }
- 18. Secure Arch: APIs Authorization Hypothetical case Account Service GET /my/ Transfer Service POST /transfer/{dst_acocunt} Receipt Service GET /receipts/ Resource Owner Mobile Browser Fintech API GET /my POST /transfer/{dst_account} GET /receipts Oauth Filter Oauth Filter “offline introspection/validation” “offline introspection/validation” “introspection/validation”Oauth Filter Oauth Filter
- 19. Secure Arch: APIs Authorization Keycloak Open Source Identity and Access Management For Modern Applications and Services
- 20. Secure Arch: APIs Authorization Installing Keycloak $ curl -O https://downloads.jboss.org/keycloak/3.2.1.Final/keycloak-3.2.1.Final.tar.gz $ tar xzvf keycloak-3.2.1.Final.tar.gz $ cd keycloak-3.2.1.Final $ ./bin/add-user-keycloak.sh -u admin $ ./bin/standalone.sh -b 192.168.122.1 ● Tip to enable MySQL as RDBMSTip to enable MySQL as RDBMS – https://github.com/Codingpedia/codingmarks-api/wiki/Keycloak-MySQL-Setuphttps://github.com/Codingpedia/codingmarks-api/wiki/Keycloak-MySQL-Setup $ sudo docker run -e KEYCLOAK_USER=admin -e KEYCLOAK_PASSWORD=123456 -d -p 8080:8080 --name keycloak-php jboss/keycloak ● Via DockerVia Docker ● http://www.keycloak.org/downloads.htmlhttp://www.keycloak.org/downloads.html
- 25. References: OAuth 2.0 https://tools.ietf.org/html/rfc7617 - The ‘Basic’ HTTP Authentication Scheme https://tools.ietf.org/html/rfc6749 - The Oauth 2.0 Authorization Framework https://tools.ietf.org/html/rfc6750 - The OAuth 2.0 Authorization Framework: Bearer Token Usage https://tools.ietf.org/html/rfc6819 - OAuth 2.0 Threat Model and Security Considerations https://tools.ietf.org/html/rfc7009 - OAuth 2.0 Token Revocation https://tools.ietf.org/html/rfc7662 - OAuth 2.0 Token Introspection https://tools.ietf.org/html/rfc8252 - OAuth 2.0 for Native Apps (Updated 6749) - Oct 2017 JOSE – JSON Object Signing and Encryption https://tools.ietf.org/html/rfc7515 - JSON Web Signature (JWS) https://tools.ietf.org/html/rfc7516 - JSON Web Encryption (JWE) https://tools.ietf.org/html/rfc7517 - JSON Web Key (JWK) https://tools.ietf.org/html/rfc7518 - JSON Web Algorithms (JWA) https://tools.ietf.org/html/rfc7519 - JSON Web Token (JWT) OpenID Connect http://openid.net/specs/openid-connect-core-1_0.html - OpenID Connect Core 1.0 http://openid.net/specs/openid-connect-discovery-1_0.html - OpenID Connect Discovery 1.0
- 26. Obrigado! #dontstophacking ● Erick Belluci Tedeschi ● erick@oerick.com ● https://twitter.com/ericktedeschi ● https://linkedin.com/in/ericktedeschi