Secure your APIs using OAuth 2 and OpenID Connect

Overview of OAuth and OpenID ConnectThe Nuts and Bolts of API Security

By Travis Spencer, CEO@travisspencer, @2botech

üAll API ConferencesüAPI CommunityüActive blogosphere

Organizers and founders

Agenda

§ The security challenge in context§ OAuth 2 Fundamentals§ Building OpenID Connect on OAuth§ 2 example use cases

API Security == API Keys

§ Problem solved!

API Security != API Keys

§ Revocable, un-audienced, non-expiring, bearer access tokens

§ Symmetric keys§ Passwords!

API Security == OAuth

§ Problem solved for real this time?

Crucial Security Concerns

Enterprise Security API Security Mobile Security

Identity is Central

MDM MAM

MobileSecurity

APISecurity

EnterpriseSecurity

Identity

Venn diagram by Gunnar Peterson

The Neo-security Stack

JSON Identity Suite

OpenID Connect

OAuth 2

Provisioning

Identities

Federation

Delegated Access

Authorization

U2FAuthentication

§ OAuth 2 is a protocol of protocols§ Used as the base of other specifications§ OpenID Connect, UMA, HEART, etc.

§ Addresses some important requirements§ Delegated access§ No password sharing§ Revocation of access

1. Resource Owner (RO)2. Client3. Authorization Server (AS)4. Resource Server (RS) (i.e., API)

Delegate

RSClient

Use a token

OAuth Actors

Request, Authenticate & Consent

The Client Requests Access

Resource Owner (RO) Authorization Server (AS)

Resource Server (RS)Client

The AS Requires the RO to Authenticate

The AS Issues the One-time Use Code

The Client Redeems the One-time Use Code

The AS Issues the Token

The Client Presents the Token to the RS

The RS Validates the Token

Resource Owner (RO)

Authorization Server (AS)

Access!

§ Like permissions§ Scopes specify extent of tokens’ usefulness§ Listed on consent UI (if shown)§ No standardized scopes

Scopes

Kinds of Tokens

Access Tokens

Like a Session

Used to secure API calls

Refresh Tokens

Like a Password

Used to get new access tokens

Holder of Key

HoK tokens are like credit cards

Profiles of Tokens

Bearer

Bearer tokens are like cash

Types of Tokens

§ WS-Security§ SAML§ Custom

§ Home-grown§ Oracle Access Manager§ SiteMinder

§ JWT

JWT Tokens

§ Pronounced like the English word “jot”§ Lightweight tokens passed in HTTP headers & query strings§ Akin to SAML tokens

§ Less expressive§ Less security options§ More compact§ Encoded w/ JSON not XML

Passing Tokens

123XYZ

John Doe

By Value By Reference

Not for authentication

Not really for authorization

Not for federation

Improper Usage of OAuth

For delegated accessUser to app delegation in particular

Proper Usage of OAuth

• Next generation federation protocol – Based on OAuth 2– Made for mobile– Not backward compatible

• Client & API receive tokens• User info endpoint provided for

client to get user data

OpenID Connect

Get user info using access token

OpenID Connect Example

OAuth AS / OpenID Provider RP / Client

Browser

Access code

Send code to get access token

Access token & ID token

Check audience restriction of ID token

Request login, providing “openid” scope & user info

scopes

User info

ID Token is for Client

§ Access token is for API; ID token is for client§ ID token provides client with info about

§ Intended client recipient§ Username § Credential used to login§ Issuer of token§ Expiration time

User Info Endpoint

§ Token issuance and user discovery endpoint

§ Authenticate using bearer access token issued by OpenID Provider

§ Output depends on requested and authorized scopes

§ sub claim must match sub claim in ID token

Applying All this to Micro-services

All Micro-services Accept JWTs

Resource Owner (RO)

Translate from by-ref to by-value in gateway

Resource Owner (RO)123XYZ

API Firewall /Reverse Proxy

Additional Resources

§ Blog posts§ bit.ly/oauth-deep-dive§ bit.ly/4-api-security-defenses§ bit.ly/building-secure-api§ bit.ly/right-api-armor§ API keys http://bit.ly/2dI9Z7Q

§ Videos§ bit.ly/oauth-in-depth§ bit.ly/micro-services-security§ bit.ly/building-secure-api-video

§ API security insights§ http://nordicapis.com/api-

insights/security/

For more information, visit curity.io

Summary

§ API security > API keys & OAuth§ OAuth 2 fundamentals

§ Token types§ Profiles§ Passing tokens

§ Building OpenID Connect on OAuth

Thank you!

Secure your APIs using OAuth 2 and OpenID Connect

Software

Transcript of Secure your APIs using OAuth 2 and OpenID Connect

LASCON 2017: SAML v. OpenID v. Oauth

Yahoo! OpenID and OAuth

Single Sign-On Security - Hackmanit...3 History of Single Sign-On OAuth 1.0 Oct 2007 OAuth 2.0 Oct 2012 OAuth 1.0 Rev A Jun 2009 OpenID Connect 1.0 Feb 2014 OpenID 1.1 May 2006 OpenID

Oauth vs OpenId

Securing your APIs with OAuth, OpenID, and OpenID Connect

Identity and Data Access: OpenID & OAuth

OAuth 2.0 & OpenID Connect #MA7

Online Identity for Community Managers: OpenID, OAuth, Information Cards

OpenId Tech Night vol.6 OAuth

OpenID Connect & OAuth - Demystifying Cloud Identity

Single Sign On with OAuth and OpenID

Enterprise Openid Sso Oauth for Google Apps

Securing APIs with OAuth 2.0

Federated Shibboleth, OpenID , oAuth , and Multifactor

アイデンティティ2.0とOAuth/OpenID Connect

Federated Shibboleth, OpenID, oAuth, and Multifactor Shibboleth, OpenID, oAuth, and Multifactor | 1 Federated Shibboleth, OpenID, oAuth, and Multifactor Russell Beall Senior Programmer/Analyst

The Essential OAuth Primer: Understanding OAuth for Securing Cloud APIs

Authentication, Authorization, OAuth, OpenID Connect and Pyramid

Advanced API Security Healthcare Information Privacy ... › sgw › documents › 1451044 › ... · Securing APIs with OAuth, OpenID, and JSON Practical API Security is a complete

OpenID vs OAuth - Identity on the Web