The Hitchhiker's Guide to the Land of OAuth
Download as PPTX, PDF0 likes231 views
The document discusses OAuth 2.0 and related identity standards, emphasizing the evolution of web applications and client architecture. It outlines the roles of resource servers, authorization servers, and clients in access management and token security. Additionally, it covers concepts such as identity federation and user-managed access.
The Hitchhiker's Guide to the Land of OAuth
- 1. © 2016 ForgeRock. All rights reserved. Chris Adriaensen Senior Customer Engineer chris.adriaensen@forgerock.com @chrisadriaensen | @ForgeRock © 2017 ForgeRock. All rights reserved. The Hitchhiker’s Guide to the LAND of OAUTH
- 2. © 2016 ForgeRock. All rights reserved. © 2017 ForgeRock. All rights reserved. KJERAGBOLTEN NORWAY 2
- 3. © 2016 ForgeRock. All rights reserved. 3 “In the beginning the Internet was created. This has made a lot of people very angry and been widely regarded as a bad move.” © 2017 ForgeRock. All rights reserved.
- 4. © 2016 ForgeRock. All rights reserved. Desktop Web 1.0 Web 2.0 Mobile Embedded 4 Application Evolution © 2017 ForgeRock. All rights reserved. “Fat” Client “Thin” Client Internet SO LONG THX
- 5. © 2016 ForgeRock. All rights reserved. Requesting PartyClientsResources AccessResource Owner User Interface (GUI / PUI) Application Interface (REST / SOAP) User Interface (GUI / PUI) Application 5 Client Architecture © 2017 ForgeRock. All rights reserved.
- 6. © 2016 ForgeRock. All rights reserved. Resource Owner User Interface (GUI / PUI) Requesting PartyClientsResources Access User Interface (GUI / PUI) Application Interface (REST / SOAP) Application 6 Access Challenge © 2017 ForgeRock. All rights reserved. ID ID ID ID ID ID IDIDIDID ID
- 7. © 2016 ForgeRock. All rights reserved. 7 © 2017 ForgeRock. All rights reserved.
- 8. © 2016 ForgeRock. All rights reserved. Requesting Party User Interface (GUI / PUI) Resource Owner User Interface (GUI / PUI) ClientsResources Access Application Interface (REST / SOAP) Application 8 Identity Solution © 2017 ForgeRock. All rights reserved. ID ID ID ID ID ID ID ID IdentityID
- 9. © 2016 ForgeRock. All rights reserved. Requesting Party User Interface (GUI / PUI) Resource Owner User Interface (GUI / PUI) ClientsResources Access Application Interface (REST / SOAP) Application 9 Access Solution © 2017 ForgeRock. All rights reserved. ID ID ID ID ID IDID Access ID ID Identity
- 10. © 2016 ForgeRock. All rights reserved. 10 © 2017 ForgeRock. All rights reserved.
- 11. © 2016 ForgeRock. All rights reserved. CONSUMERENTERPRISE OASIS 11 Open Standards © 2017 ForgeRock. All rights reserved. IETF, OIDF & KANTARA OIDC Identity Federation UMA Access Federation OAuth Access Control Consent Security Scalability Browser Client Generic Client Statefull Design Stateless Design XML / SOAP JSON / REST JWT Identity 2000+ 2010+ SAML Identity Federation XACML Access Federation WS-* Access SAML Identity
- 12. © 2016 ForgeRock. All rights reserved. 12 © 2017 ForgeRock. All rights reserved.
- 13. © 2016 ForgeRock. All rights reserved. 13 OAuth 2.0 Standard © 2017 ForgeRock. All rights reserved. Resource Server Authorization Server Resource Owner Client Access Validate Manage Authorize Control Owner-to-App Sharing Synchronous Consent Access Integration Access Tokens
- 14. © 2016 ForgeRock. All rights reserved. 14 OAuth 2.0 Options © 2017 ForgeRock. All rights reserved. FLOW USAGE Authorization Grant User-Agent <> Client Implicit Grant Client Credentials Resource Owner Credentials Device Flow User-Agent == Client Client == Resource Owner Exceptional!! Constrained User Interface
- 15. © 2016 ForgeRock. All rights reserved. 15 OpenID Connect Standard © 2017 ForgeRock. All rights reserved. Authorization Server Identity Owner Client Access Manage Authenticate Control Identity Owner-to-App Sharing Synchronous Consent Access Integration Access Tokens Identity Tokens
- 16. © 2016 ForgeRock. All rights reserved. 16 User Managed Access Standard © 2017 ForgeRock. All rights reserved. Resource Server Authorization Server Requesting Party Client Authorize Access Protect Resource Owner Manage Manage Control Negotiate Owner-to-Party Sharing Asynchronous Consent Access Federation Access Tokens
- 17. © 2016 ForgeRock. All rights reserved. Requesting PartyClientsResources AccessResource Owner User Interface (GUI / PUI) Application Interface (REST / SOAP) User Interface (GUI / PUI) Application 17 Client Standards © 2017 ForgeRock. All rights reserved. OAuth 2.0 Device Flow Standard OAuth 2.0 User Managed Access OpenIDConnect
- 18. © 2016 ForgeRock. All rights reserved. 18 Token Security © 2017 ForgeRock. All rights reserved. CLIENT TOKEN Authentication & Authorization Signature Authentication & Authorization EncryptionSecure Channel Secure Channel SERVER Proof-of-PossessionSecure Storage Usage Analysis Liability Transit Owner
- 19. © 2016 ForgeRock. All rights reserved. 19 © 2017 ForgeRock. All rights reserved. “Protect your cookies... euhm tokens!”
- 20. © 2016 ForgeRock. All rights reserved. Chris Adriaensen Senior Customer Engineer chris.adriaensen@forgerock.com @chrisadriaensen | @ForgeRock © 2017 ForgeRock. All rights reserved. End of SHOW