Introduction to the most popular delegation protocol and its extension - OpenID Connect.

1. OAuth2 &
OpenID Connect
Marcin Wolnik

2. Basic terms
• Authentication
• verifies who user is
• Authorization
• verifies what user is allowed to do

3. Past landscape
• Thick clients (WinForms, WPF)
• Windows Auth
• Server-side web apps (Web Forms, MVC)
• Windows Auth
• Forms Auth

4. Server-side web apps
User Web App

5. Present
User
3rd party Web App
API 1
API 2 Graph API
Maps API
Native

6. Replay credentials
User
ResourceApplication
OAuth2 in Action

7. Special password
Resource Owner
ResourceApplication
OAuth2 in Action

8. OAuth2
Delegation protocol, a means of letting someone who controls a resource allow
an application to access that resource on their behalf without impersonating
them.

9. Actors
OAuth2 in Action
Access Token
Resource Owner
Protected ResourceClient
Authorization Server

10. OAuth2 flow
Resource Owner
Protected ResourceClient
OAuth2 in Action
Authorization Server
1
2
3
4
5
6

11. Access token
API 1
API 2
=
Bus 1
Bus 2
Bus UK

12. Access token is opaque to a client

13. Authentication?
Resource Owner
Protected ResourceClient
Authorization Server

14. OAuth2 abuse
User
Facebook Graph APIWeb App
Facebook Auth Server
Malicious App

15. OAuth2 abuse real-life example

16. OpenID Connect
• Identity layer on top of the OAuth2 protocol
• Client app requests identity token and use it to sign in a user
• Additional endpoint that can be used to get additional user details

17. Clients
Confidential
Able to maintain shared secret with
Identity Provider
On server
(Server-side web apps)
Public
Redirect URI to verify client
On device
(JavaScript apps, Mobile apps)

18. Client – IdP communication
Front-channel
Browser as a medium
Data send in query parameter
Less secure
Back-channel
No browser
Direct Server-to-Server calls
More secure

19. Authorization Code Flow
+
Confidential client UserInfo Endpoint (API)
Identity Provider
User
Authorization Endpoint Token Endpoint
(ASP.NET Core)

20. OpenID Connect Flows
Authorization Code
Tokens via back-channel
Confidentional clients
Refresh tokens available

21. Implicit Flow
+
Public client UserInfo Endpoint (API)
Identity Provider
User Authorization Endpoint Token Endpoint
(React)

22. OpenID Connect Flows
Authorization Code
Tokens via back-channel
Confidentional clients
Refresh tokens available
Implicit
Tokens via front-channel
Public clients
No refresh tokens

23. Hybrid Flow
+
Confidential client UserInfo Endpoint (API)
Identity Provider
User
Authorization Endpoint Token Endpoint
(ASP.NET Core)

24. OpenID Connect Flows
Authorization Code
Tokens via back-channel
Confidentional clients
Refresh tokens available
Implicit
Tokens via front-channel
Public clients
No refresh tokens
Hybrid
Tokens via front/back-channel
Confidential clients
Reresh tokens available

25. Example
Sensors Dashboard Sensors API
IdSrv4User
Azure AD

26. DEMO

27. Contact
@wolnikmarcin
Crokus
https://github.com/Crokus/aspnetcore-idsrv-aad-example