More Related Content
![[APIdays INTERFACE 2021] The Evolution of API Security for Client-side Applic...](/proxy?url=https%3A%2F%2Fcdn.slidesharecdn.com%2Fss_thumbnails%2Fapidays-interface-johannstalk-210709062455-thumbnail.jpg%3Fwidth%3D640%26height%3D640%26fit%3Dbounds)
Y U No OAuth?!?
- 1. Y U NOOAUTH?!? Using Common Patterns to Secure Your Web Applications Jason Robert Twitter – @jasontrobert Website – espressocoder.com Linkedin – in/jasonrobert/
- 2. Meet the Speaker ■Software Architect ■ Auth0 Ambassador ■ Bootcamp Instructor ■ Blogs @ https://espressocoder.com ■ PASSIONATE DEVELOPER & MENTOR
- 3. Roadmap ■ Progression ofUser Management in the Web ■ JWTs, OAuth 2.0, and OpenID Connect ■ Authentication Methods ■ Choosing an Identity Provider
- 4. PROGRESSION OF USER MANAGEMENTIN THE WEB
- 5. “Roll Your Own” ■You’re responsible for all aspects of identity management – User management, storage, and authentication ■ Users need to be created, administered, and managed ■ Users and passwords in a persistent store – Please tell me you hashed and salted those passwords! ■ Session managed via session state and/or cookie
- 6. ASP.NET Identity ■ Introducedin ASP.NET 2.0 – aspnet_regsql.exe – ASPNET Web Administration Tool ■ Designed to solve common site membership requirements ■ Forms-based Authentication (user-name / password) ■ Database backend for user names, passwords, and profile data – Profile data requires the Profile Provider API
- 7. Modern ASP.NET Identity ■ASP.NET Identity works with claims-based authentication – Identity is represented as a set of claims ■ Supports redirection-based login with authentication providers – Google, Facebook, Twitter, etc. ■ Storage based on EF Core and extensible ■ Distributed as a NuGet package(s) – Microsoft.AspNetCore.EntityFramework.Identity
- 8. Distributed Web Architectures ■But what about… – Dealing with multiple web applications – Native or legacy systems – Server to server communication – 3rd party integration – Single sign-on ■ ASP.NET Identity alone isn’t always ideal for distributed architectures like Microservices ■ Is there another way?
- 9. USE AN OAUTH2.0 IDENTITY PROVIDER
- 10. What is anIdentity Provider? ■ Creates, maintains, and manages information for principals while providing authentication services to relying applications ■ Provides centralized login and workflow for all of your applications – Web, native, mobile, etc. ■ Hosted as a separate web application (Separation of Concerns) ■ Enables Single Sign-on – User friendly – Reduces attack surface
- 11.
- 12. JSON Web Tokens(JWTs) ■ Compact and self-contained way to securely transmit information between two applications ■ Contains claims about a principal enabling authorization rules to be enforced ■ A JWT is digitally signed to verify authenticity ■ Typically Base64 encoded but can be encrypted via JSON Web Encryption (JWE)
- 13. Structure of aJWT ■ Header – Contains two key pieces of information ■ The type of the token (JWT) ■ The signing algorithm ■ Payload – Contains the claims ■ Claims are statements about an entity / user ■ Signature – Contains a signature of the Header & Payload ■ Typically uses a strong encryption algorithm
- 14.
- 15. ID Token vsAccess Token ■ ID Token – Shows client application that user authenticated successfully – Contains information (claims) about a principle – Authentication response ■ Access Token – Provides “access” to a secure resource – Typically used as a bearer token – Should be managed securely
- 16. OAuth 2.0 ■ Industry-standardprotocol for authorization ■ Provides specific authorization processes for web, desktop, and mobile applications ■ Describes several “grant types” for acquiring an access token – Client Credentials – Password – Authorization Code – Implicit
- 17. OpenID Connect ■ OpenIDConnect is an authentication protocol based on the OAuth 2.0 specifications ■ OpenID Connect lets developers authenticate their users across websites and apps ■ Presents three flows for authentication that dictate how authentication is handled by the Identity Provider – Authorization Code Flow – Implicit Flow – Hybrid Flow
- 18.
- 19. WHAT TYPES OF APPLICATIONS DO YOUWORK WITH?
- 20.
- 21. Client Credentials ■ Obtaina token outside the context of a user ■ Use to when communicating across two backend systems ■ Authentication is performed via client_id & client_secret ■ Think of Client ID & Client Secret as UserName and Password Client ID / Client Secret may be required as a Basic Auth header or included in the post body The grant_type is client_credentials
- 22.
- 23. Client Credentials Expiration When thetoken expires Audience Who the token is for Issuer Where the token came from
- 24. Client ID andClient Secret provided in authentication header The grant_type must be set to client_credentials
- 25. The token isprovided in an authorization header as a Bearer token
- 26. Authority must match the“iss” claim Audience must match the “aud” claim
- 27.
- 28. Password ■ Similar toclient credentials but, with a user’s context ■ Use with native or legacy applications – Never use with your web apps! ■ Requires user name and password – In addition to client_id and client_secret Username and password fields are introduced The grant_type is password
- 29.
- 30. Password Authentication Method Reference Howthe principle authenticated Password-based Authentication Subject Unique Id for the principle
- 31. Username and password arenow included in the request Client ID and Client Secret provided in authentication header
- 32. The password tokenis provided to the api in the exact same way as before
- 33. Authorization Policies can beused for routes that require a “sub” claim Authentication is setup in the same way
- 34. Policies can beassigned to controllers for authorization
- 35.
- 36. Implicit Flow ■ Thebrowser requests a token directly from the authorization server ■ The authorization server redirects to the redirect_uri with the id_token ■ Can be used with server-side web applications such as ASP.NET Core MVC ■ Do not use with Single Page Apps Token is returned via redirect
- 37.
- 39. Implicit Flow Nonce usedto prevent replay attacks. Must match the nonce provided by initial redirect request Unique Session ID
- 40. ASP.NET Core Middleware canbe used to facilitate OpenIdConnect Implicit Flow After the id_token is received a session is established with the web application
- 41.
- 42. Hybrid Flow 1 2 ■ Usesredirect uri to return id_token AND code ■ Use with server-side web applications that additionally need to call a separate backend api ■ Code is used server-side in order to retrieve an access_token ■ Authorization code is used in conjunction with Client Secret which stays server side
- 43.
- 44. ASP.NET Core Middleware canbe used to facilitate OpenIdConnect Implicit Flow ASP.NET Core Middleware can be used to facilitate OpenIdConnect Implicit Flow
- 45.
- 46. Why Implicit Flow isbad for SPAs ■ SPA applications need an access_token ■ Response types causing the authorization server to issue access tokens in the authorization response are vulnerable to access token leakage ■ Don’t panic if you are using implicit flow but, recognize better options are now available
- 47. Authorization Code withPKCE ■ New recommendation for SPAs ■ Redirect from authorization server only contains an authorization code – Protected by PKCE ■ PKCE mitigates the threat of having the authorization code intercepted ■ Browser requests token with authorization code 1 2
- 48.
- 49.
- 50. Weighing Your Options ■Choose an Identity Provider that fits with your ecosystem – Is your solution an internal application? – Is your solution cloud hosted? – Which cloud provider do you use? – What level of control is required? ■ Validate it is OpenID Connect Certified!
- 51. On-Premise… Active Directory FederationServices 2016
- 52.
- 53.
- 54. Graduated! You’ve learned… ■ Progressionof User Management in the Web ■ JWTs, OAuth 2.0, and OpenID Connect ■ Authentication Methods ■ Choosing an Identity Provider
- 55. Jason Robert Twitter -@jasontrobert Website – espressocoder.com Linkedin - in/jasonrobert/
Editor's Notes
- #8 Community Maintained Store Providers ASP.NET Identity MongoDB Providers: By Tugberk Ugurlu By Alexandre Spieser ASP.NET Identity LinqToDB Provider ASP.NET Identity DynamoDB Provider ASP.NET Identity RavenDB Providers: By Judah Gabriel Himango By Iskandar Rafiev ASP.NET Identity Cassandra Provider ASP.NET Identity Firebase Provider ASP.NET Identity Redis Provider ASP.NET Identity DocumentDB