1. Prabath Siriwardena

2. • Exposing
business
functionality
to
the
rest
of
the
world.
• Private
APIs
vs.
Public
APIs
• Securing,
Throttling,
Monitoring,
Monetizing

3. • XML
over
HTTP
• JSON
over
HTTP
• SOAP
over
HTTP

5. • Basic
Authentication
• Mutual
Authentication
• Custom
Authentication
Schemes
(e.g.
AWS)
• What’s
wrong
?

10. Third-­‐party
applications
are
required
to
store
the
resource
owner's
credentials
for
future
use,
typically
a
password
in
clear-­‐
text.

11. Servers
are
required
to
support
password
authentication,
despite
the
security
weaknesses
created
by
passwords.

12. Third-­‐party
applications
gain
overly
broad
access
to
the
resource
owner's
protected
resources,
leaving
resource
owners
without
any
ability
to
restrict
duration
or
access
to
a
limited
subset
of
resources.

13. Resource
owners
cannot
revoke
access
to
an
individual
third-­‐
party
without
revoking
access
to
all
third-­‐parties,
and
must
do
so
by
changing
their
password.

14. Compromise
of
any
third-­‐party
application
results
in
compromise
of
the
end-­‐user's
password
and
all
of
the
data
protected
by
that
password.

21. • Complexity
in
validating
and
generating
signatures.
• No
clear
separation
between
Resource
Server
and
Authorization
Server.
• Browser
based
re-­‐redirections.
• Not
a
framework

22. • An
entity
capable
of
granting
access
to
a
protected
resource.
• When
the
resource
owner
is
a
person,
it
is
referred
to
as
an
end-­‐user.

23. • The
server
hosting
the
protected
resources,
capable
of
accepting
and
responding
to
protected
resource
requests
using
access
tokens.

24. • An
application
making
protected
resource
requests
on
behalf
of
the
resource
owner
and
with
its
authorization

25. • The
server
issuing
access
tokens
to
the
client
after
successfully
authenticating
the
resource
owner
and
obtaining
authorization

27. Authorization
Code
Implicit
Resource
Owner
Password
Credentials
Client
Credentials

28. OAuth
Handshake
Scope

29. OAuth
Handshake
Scope
Scope
is
defined
by
the
Authorization
Server.
Scope
indicates
what
resource
client
wants
access
and
which
actions
he
wants
to
perform
on
that.
The
value
of
the
scope
parameter
is
expressed
as
a
list
of
space-­‐delimited,
case
sensitive
strings.
The
strings
are
defined
by
the
authorization
server.

30. Confidential
Client
Type
Web
Application
OAuth
Handshake

31. Client
Authenticates
to
AuthZ
Server
BasicAuth
client_id
/
client_secret
OAuth
Handshake

32. Authorization
Grant
Request
OAuth
Handshake
•
response_type
:
REQUIRED.
Value
MUST
be
set
to
"code".
•
client_id
:
REQUIRED.
The
client
identifier.
•
redirect_uri
:
OPTIONAL.
Where
to
be
redirected
by
the
Authorization
Server.
•
scope
:
OPTIONAL.
The
scope
of
the
access
request.
•
state
:
RECOMMENDED.
An
opaque
value
used
by
the
client
to
maintain
state
between
the
request
and
callback.

33. Authorization
Grant
Response
OAuth
Handshake
•
code:
REQUIRED.
The
authorization
code
generated
by
the
authorization
server
•
state
:
REQUIRED
if
the
"state"
parameter
was
present
in
the
client
authorization
request.

34. Access
Token
Request
OAuth
Handshake
• grant_type
:
REQUIRED.
Value
MUST
be
set
to
"authorization_code".
• code
:
REQUIRED.
The
authorization
code
received
from
the
Authorization
Server.
• redirect_uri
:
REQUIRED,
if
the
"redirect_uri"
parameter
was
included
in
the
authorization

35. Access
Token
Response
OAuth
Handshake
• access_token
:
REQUIRED.
The
access
token
issued
by
the
authorization
server.
• token_type
:
REQUIRED.
The
type
of
the
token.
Value
is
case
insensitive.
• expires_in
:
RECOMMENDED.
The
lifetime
in
seconds
of
the
access
token

36. OAuth
Handshake
Scope

37. Public
Client
Type
User
Agent
based
Application
OAuth
Handshake

38. Anonymous
Clients
OAuth
Handshake

39. OAuth
Handshake
Authorization
Grant
Request
•
response_type
:
REQUIRED.
Value
MUST
be
set
to
”token".
•
client_id
:
REQUIRED.
The
client
identifier.
•
redirect_uri
:
OPTIONAL.
Where
to
be
redirected
by
the
Authorization
Server.
•
scope
:
OPTIONAL.
The
scope
of
the
access
request.
•
state
:
RECOMMENDED.
An
opaque
value
used
by
the
client
to
maintain
state
between
the
request
and
callback.

40. Access
Token
Response
OAuth
Handshake
• access_token
:
REQUIRED.
The
access
token
issued
by
the
authorization
server.
• token_type
:
REQUIRED.
The
type
of
the
token.
Value
is
case
insensitive.
• expires_in
:
RECOMMENDED.
The
lifetime
in
seconds
of
the
access
token
• scope
:
OPTIONAL,
if
identical
to
the
scope
requested
by
the
client,
otherwise
REQUIRED.
• state
:
REQUIRED
if
the
"state"
parameter
was
present
in
the
client
authorization
request

41. OAuth
Handshake
Scope

42. Confidential
Client
Type
OAuth
Handshake

43. BasicAuth
OAuth
Handshake

44. OAuth
Handshake
Authorization
Grant
Request
Since
the
client
authentication
is
used
as
the
authorization
grant,
no
additional
authorization
request
is
needed.

45. OAuth
Handshake
Access
Token
Request
• grant_type
:
REQUIRED.
Value
MUST
be
set
to
”client_credentials".
• scope:
OPTIONAL.
The
scope
of
the
access
request.
Note
:
The
client
needs
to
pass
BasicAuth
headers
or
authenticate
to
the
Authorization
Server
in
other
means.

46. Access
Token
Response
OAuth
Handshake
• access_token
:
REQUIRED.
The
access
token
issued
by
the
authorization
server.
• token_type
:
REQUIRED.
The
type
of
the
token.
Value
is
case
insensitive.
• expires_in
:
RECOMMENDED.
The
lifetime
in
seconds
of
the
access
token

47. OAuth
Handshake
Scope

48. Confidential
Client
Type
OAuth
Handshake

49. BasicAuth
OAuth
Handshake

50. OAuth
Handshake
Authorization
Grant
Request
The
method
through
which
the
client
obtains
the
resource
owner
credentials
is
beyond
the
scope
of
this
specification.
The
client
MUST
discard
the
credentials
once
an
access
token
has
been
obtained

51. OAuth
Handshake
Access
Token
Request
• grant_type
:
REQUIRED.
Value
MUST
be
set
to
”client_credentials".
• username
:
REQUIRED.
The
resource
owner
username,
encoded
as
UTF-­‐8.
• password
:
REQUIRED.
The
resource
owner
password,
encoded
as
UTF-­‐8.
• scope:
OPTIONAL.
The
scope
of
the
access
request.

52. Access
Token
Response
OAuth
Handshake
• access_token
:
REQUIRED.
The
access
token
issued
by
the
authorization
server.
• token_type
:
REQUIRED.
The
type
of
the
token.
Value
is
case
insensitive.
• expires_in
:
RECOMMENDED.
The
lifetime
in
seconds
of
the
access
token

53. Runtime

54. Runtime
Bearer
MAC

55. Runtime
Bearer
MAC
Any
party
in
possession
of
a
bearer
token
(a
"bearer")
can
use
it
to
get
access
to
the
associated
resources
(without
demonstrating
possession
of
a
cryptographic
key).
Bearer

56. Request
with
Bearer
GET
/resource/1
HTTP/1.1
Host:
example.com
Authorization:
Bearer
“access_token_value”
Runtime
http://tools.ietf.org/html/draft-­‐ietf-­‐oauth-­‐v2-­‐bearer-­‐20

57. Runtime
Bearer
MAC
HTTP
MAC
access
authentication
scheme
MAC

58. Request
with
MAC
GET
/resource/1
HTTP/1.1
Host:
example.com
Authorization:
MAC
id="h480djs93hd8",
ts="1336363200”,
nonce="274312:dj83hs9s",
mac="kDZvddkndxvhGRXZhvuDjEWhGeE="
Runtime
http://tools.ietf.org/html/draft-­‐ietf-­‐oauth-­‐v2-­‐http-­‐mac-­‐01