Secure your APIs using OAuth 2 and OpenID Connect

Overview of OAuth and OpenID Connect
The Nuts and Bolts of API Security
By Travis Spencer, CEO
@travisspencer, @2botech
Copyright © 2013-2017 Twobo Technologies AB. All rights reserved

ü All API Conferences
ü API Community
ü Active blogosphere
Organizers
and founders

Agenda
§ The security challenge in context
§ OAuth 2 Fundamentals
§ Building OpenID Connect on OAuth
§ 2 example use cases

API Security == API Keys
§ Problem solved!
Copyright © 2013-2017 Twobo Technologies AB. All rights reserved @travisspencer / @2botech

API Security != API Keys
§ Revocable, un-audienced, non-expiring, bearer access
tokens
§ Symmetric keys
§ Passwords!

API Security == OAuth
§ Problem solved for real this time?
Not that easy! Sorry L

Crucial Security Concerns
Enterprise Security API Security Mobile Security

Identity is Central
MDM MAM
Mobile
Security
API
Security
Enterprise
Security
Identity
Venn diagram by Gunnar Peterson
AuthZ

The Neo-security Stack
JSON Identity Suite
OpenID Connect
SCIM
OAuth 2
Provisioning
Identities
Federation
Delegated Access
Authorization
U2FAuthentication

§ OAuth 2 is a protocol of protocols
§ Used as the base of other specifications
§ OpenID Connect, UMA, HEART, etc.
§ Addresses some important requirements
§ Delegated access
§ No password sharing
§ Revocation of access
OAuth

1. Resource Owner (RO)
2. Client
3. Authorization Server (AS)
4. Resource Server (RS) (i.e., API)
Getatoken
Delegate
RSClient
AS
RO
Use a token
OAuth Actors

Request, Authenticate & Consent

The Client Requests Access
Resource Owner (RO) Authorization Server (AS)
Resource Server (RS)Client

The AS Requires the RO to Authenticate

The AS Issues the One-time Use Code

The Client Redeems the One-time Use Code

The AS Issues the Token

The Client Presents the Token to the RS

The RS Validates the Token
Resource Owner (RO)
Authorization Server (AS)

Access!

§ Like permissions
§ Scopes specify extent of tokens’ usefulness
§ Listed on consent UI (if shown)
§ No standardized scopes
Scopes

Kinds of Tokens
Access Tokens
Like a Session
Used to secure API calls
Refresh Tokens
Like a Password
Used to get new access tokens

Holder of Key
HoK tokens are like
credit cards
Profiles of Tokens
Bearer
Bearer tokens are like
cash
$

Types of Tokens
§ WS-Security
§ SAML
§ Custom
§ Home-grown
§ Oracle Access Manager
§ SiteMinder
§ JWT

JWT Tokens
§ Pronounced like the English word “jot”
§ Lightweight tokens passed in HTTP headers & query strings
§ Akin to SAML tokens
§ Less expressive
§ Less security options
§ More compact
§ Encoded w/ JSON not XML

Passing Tokens
123XYZ
John Doe
By Value By Reference

Not for authentication
Not really for authorization
Not for federation
Improper Usage of OAuth

For delegated access
User to app delegation in particular
Proper Usage of OAuth

• Next generation federation
protocol
– Based on OAuth 2
– Made for mobile
– Not backward compatible
• Client & API receive tokens
• User info endpoint provided for
client to get user data
OpenID Connect

Get user info using
access token
OpenID Connect Example
OAuth AS / OpenID
Provider
RP / Client
Browser
Access code
Send code to get
access token
Access token & ID token
Check audience
restriction of ID token
Request login,
providing “openid”
scope & user info
scopes
User info

ID Token is for Client
§ Access token is for API; ID token is for client
§ ID token provides client with info about
§ Intended client recipient
§ Username
§ Credential used to login
§ Issuer of token
§ Expiration time

User Info Endpoint
§ Token issuance and user discovery
endpoint
§ Authenticate using bearer access
token issued by OpenID Provider
§ Output depends on requested and
authorized scopes
§ sub claim must match sub claim in ID
token

Applying All this to Micro-services

All Micro-services Accept JWTs
Resource Owner (RO)
But translate!

Translate from by-ref to by-value in gateway
Resource Owner (RO)
123
XYZ
API Firewall /
Reverse Proxy

Additional Resources
§ Blog posts
§ bit.ly/oauth-deep-dive
§ bit.ly/4-api-security-defenses
§ bit.ly/building-secure-api
§ bit.ly/right-api-armor
§ API keys http://bit.ly/2dI9Z7Q
§ Videos
§ bit.ly/oauth-in-depth
§ bit.ly/micro-services-security
§ bit.ly/building-secure-api-video
§ API security insights
§ http://nordicapis.com/api-
insights/security/

For more information, visit curity.io

Summary
§ API security > API keys & OAuth
§ OAuth 2 fundamentals
§ Token types
§ Profiles
§ Passing tokens
§ Building OpenID Connect on OAuth

Thank you!

Secure your APIs using OAuth 2 and OpenID Connect

Secure your APIs using OAuth 2 and OpenID Connect

More Related Content

What's hot (20)

Similar to Secure your APIs using OAuth 2 and OpenID Connect (20)

More from Nordic APIs (20)

Recently uploaded (20)

Secure your APIs using OAuth 2 and OpenID Connect