Introduction to OAuthdownload.microsoft.com/download/C/6/0/C60E2BD0-8A7C-479F... · 2018-10-16 ·...
Transcript of Introduction to OAuthdownload.microsoft.com/download/C/6/0/C60E2BD0-8A7C-479F... · 2018-10-16 ·...
![Page 1: Introduction to OAuthdownload.microsoft.com/download/C/6/0/C60E2BD0-8A7C-479F... · 2018-10-16 · Introduction to OAuth. What drives the need? Versions of OAuth Authentication vs.](https://reader034.fdocuments.net/reader034/viewer/2022043005/5f89b542458a98308002eb45/html5/thumbnails/1.jpg)
Andrew Davidoff
Senior Software Development Engineer (Test)
Microsoft Corporation
Introduction to OAuth
![Page 2: Introduction to OAuthdownload.microsoft.com/download/C/6/0/C60E2BD0-8A7C-479F... · 2018-10-16 · Introduction to OAuth. What drives the need? Versions of OAuth Authentication vs.](https://reader034.fdocuments.net/reader034/viewer/2022043005/5f89b542458a98308002eb45/html5/thumbnails/2.jpg)
![Page 3: Introduction to OAuthdownload.microsoft.com/download/C/6/0/C60E2BD0-8A7C-479F... · 2018-10-16 · Introduction to OAuth. What drives the need? Versions of OAuth Authentication vs.](https://reader034.fdocuments.net/reader034/viewer/2022043005/5f89b542458a98308002eb45/html5/thumbnails/3.jpg)
What drives the need?
Versions of OAuth
Authentication vs. Authorization
3
![Page 4: Introduction to OAuthdownload.microsoft.com/download/C/6/0/C60E2BD0-8A7C-479F... · 2018-10-16 · Introduction to OAuth. What drives the need? Versions of OAuth Authentication vs.](https://reader034.fdocuments.net/reader034/viewer/2022043005/5f89b542458a98308002eb45/html5/thumbnails/4.jpg)
![Page 5: Introduction to OAuthdownload.microsoft.com/download/C/6/0/C60E2BD0-8A7C-479F... · 2018-10-16 · Introduction to OAuth. What drives the need? Versions of OAuth Authentication vs.](https://reader034.fdocuments.net/reader034/viewer/2022043005/5f89b542458a98308002eb45/html5/thumbnails/5.jpg)
Limited and controlled -- granted by the user
Your app gets its own delegation credential (access token)
![Page 6: Introduction to OAuthdownload.microsoft.com/download/C/6/0/C60E2BD0-8A7C-479F... · 2018-10-16 · Introduction to OAuth. What drives the need? Versions of OAuth Authentication vs.](https://reader034.fdocuments.net/reader034/viewer/2022043005/5f89b542458a98308002eb45/html5/thumbnails/6.jpg)
FlickrAuth, Google AuthSub, Yahoo BBAuth
![Page 7: Introduction to OAuthdownload.microsoft.com/download/C/6/0/C60E2BD0-8A7C-479F... · 2018-10-16 · Introduction to OAuth. What drives the need? Versions of OAuth Authentication vs.](https://reader034.fdocuments.net/reader034/viewer/2022043005/5f89b542458a98308002eb45/html5/thumbnails/7.jpg)
![Page 8: Introduction to OAuthdownload.microsoft.com/download/C/6/0/C60E2BD0-8A7C-479F... · 2018-10-16 · Introduction to OAuth. What drives the need? Versions of OAuth Authentication vs.](https://reader034.fdocuments.net/reader034/viewer/2022043005/5f89b542458a98308002eb45/html5/thumbnails/8.jpg)
Something you knowSomething you haveSomething you are
Are you allowed to do what you are trying to do?
![Page 9: Introduction to OAuthdownload.microsoft.com/download/C/6/0/C60E2BD0-8A7C-479F... · 2018-10-16 · Introduction to OAuth. What drives the need? Versions of OAuth Authentication vs.](https://reader034.fdocuments.net/reader034/viewer/2022043005/5f89b542458a98308002eb45/html5/thumbnails/9.jpg)
Four roles in OAuth 2
Types of Clients
Logical flow
9
![Page 10: Introduction to OAuthdownload.microsoft.com/download/C/6/0/C60E2BD0-8A7C-479F... · 2018-10-16 · Introduction to OAuth. What drives the need? Versions of OAuth Authentication vs.](https://reader034.fdocuments.net/reader034/viewer/2022043005/5f89b542458a98308002eb45/html5/thumbnails/10.jpg)
Resource Owner: End-user or other entity capable of granting access to the protected resources.
Resource Server: Server that hosts the protected resources.
SkyDrive
Authorization Server: Server that authenticates the client and issues access tokens.
Microsoft account server
Client: Application making protected resource requests to the Resource Server.
Microsoft Office / http://www.mybirthdayreminders.aspx
![Page 11: Introduction to OAuthdownload.microsoft.com/download/C/6/0/C60E2BD0-8A7C-479F... · 2018-10-16 · Introduction to OAuth. What drives the need? Versions of OAuth Authentication vs.](https://reader034.fdocuments.net/reader034/viewer/2022043005/5f89b542458a98308002eb45/html5/thumbnails/11.jpg)
Can and must keep its credentials confidential
Can’t keep its credentials confidential
![Page 12: Introduction to OAuthdownload.microsoft.com/download/C/6/0/C60E2BD0-8A7C-479F... · 2018-10-16 · Introduction to OAuth. What drives the need? Versions of OAuth Authentication vs.](https://reader034.fdocuments.net/reader034/viewer/2022043005/5f89b542458a98308002eb45/html5/thumbnails/12.jpg)
Private client
Public client
Public client
![Page 13: Introduction to OAuthdownload.microsoft.com/download/C/6/0/C60E2BD0-8A7C-479F... · 2018-10-16 · Introduction to OAuth. What drives the need? Versions of OAuth Authentication vs.](https://reader034.fdocuments.net/reader034/viewer/2022043005/5f89b542458a98308002eb45/html5/thumbnails/13.jpg)
1 Authorization Request
2 Authorization Grant
4 Issue access token
6 Serve Request
3 Request access token
5 Request resource
Resource
OwnerClient
Authorization
Server
Resource
Server
![Page 14: Introduction to OAuthdownload.microsoft.com/download/C/6/0/C60E2BD0-8A7C-479F... · 2018-10-16 · Introduction to OAuth. What drives the need? Versions of OAuth Authentication vs.](https://reader034.fdocuments.net/reader034/viewer/2022043005/5f89b542458a98308002eb45/html5/thumbnails/14.jpg)
14
![Page 15: Introduction to OAuthdownload.microsoft.com/download/C/6/0/C60E2BD0-8A7C-479F... · 2018-10-16 · Introduction to OAuth. What drives the need? Versions of OAuth Authentication vs.](https://reader034.fdocuments.net/reader034/viewer/2022043005/5f89b542458a98308002eb45/html5/thumbnails/15.jpg)
Authorization Code Grant
Implicit Grant
![Page 16: Introduction to OAuthdownload.microsoft.com/download/C/6/0/C60E2BD0-8A7C-479F... · 2018-10-16 · Introduction to OAuth. What drives the need? Versions of OAuth Authentication vs.](https://reader034.fdocuments.net/reader034/viewer/2022043005/5f89b542458a98308002eb45/html5/thumbnails/16.jpg)
Follows a redirection-based flow
Uses an authorization code as an intermediate credential
Optimized for private clients
Allows renewal of access tokens
Allows client authentication
16
![Page 18: Introduction to OAuthdownload.microsoft.com/download/C/6/0/C60E2BD0-8A7C-479F... · 2018-10-16 · Introduction to OAuth. What drives the need? Versions of OAuth Authentication vs.](https://reader034.fdocuments.net/reader034/viewer/2022043005/5f89b542458a98308002eb45/html5/thumbnails/18.jpg)
Private
http://www.pandaemonium.com/callback.aspx
![Page 19: Introduction to OAuthdownload.microsoft.com/download/C/6/0/C60E2BD0-8A7C-479F... · 2018-10-16 · Introduction to OAuth. What drives the need? Versions of OAuth Authentication vs.](https://reader034.fdocuments.net/reader034/viewer/2022043005/5f89b542458a98308002eb45/html5/thumbnails/19.jpg)
000000004C0EC707
PEIpZV8eUUpGX5r2jQUw5bWlms88qUlG
![Page 20: Introduction to OAuthdownload.microsoft.com/download/C/6/0/C60E2BD0-8A7C-479F... · 2018-10-16 · Introduction to OAuth. What drives the need? Versions of OAuth Authentication vs.](https://reader034.fdocuments.net/reader034/viewer/2022043005/5f89b542458a98308002eb45/html5/thumbnails/20.jpg)
Resource
Owner
User
AgentClient Authorization Server
1a
1b 1c
• Response_type=
• “code”
• Client_id
• *Redirect_uri
• *Scope
• *State
1 User-agent loads the client, which
redirects it to the authorization
server
![Page 21: Introduction to OAuthdownload.microsoft.com/download/C/6/0/C60E2BD0-8A7C-479F... · 2018-10-16 · Introduction to OAuth. What drives the need? Versions of OAuth Authentication vs.](https://reader034.fdocuments.net/reader034/viewer/2022043005/5f89b542458a98308002eb45/html5/thumbnails/21.jpg)
Resource
Owner
User
AgentClient Authorization Server
1 User-agent loads the client, which
redirects it to the authorization server
1a
1b 1c
2 User authenticates into the
authorization server, reviews and grants
the client’s request for permissions
2b 2a2c 2d
![Page 22: Introduction to OAuthdownload.microsoft.com/download/C/6/0/C60E2BD0-8A7C-479F... · 2018-10-16 · Introduction to OAuth. What drives the need? Versions of OAuth Authentication vs.](https://reader034.fdocuments.net/reader034/viewer/2022043005/5f89b542458a98308002eb45/html5/thumbnails/22.jpg)
![Page 23: Introduction to OAuthdownload.microsoft.com/download/C/6/0/C60E2BD0-8A7C-479F... · 2018-10-16 · Introduction to OAuth. What drives the need? Versions of OAuth Authentication vs.](https://reader034.fdocuments.net/reader034/viewer/2022043005/5f89b542458a98308002eb45/html5/thumbnails/23.jpg)
![Page 24: Introduction to OAuthdownload.microsoft.com/download/C/6/0/C60E2BD0-8A7C-479F... · 2018-10-16 · Introduction to OAuth. What drives the need? Versions of OAuth Authentication vs.](https://reader034.fdocuments.net/reader034/viewer/2022043005/5f89b542458a98308002eb45/html5/thumbnails/24.jpg)
Resource
Owner
User
AgentClient Authorization Server
1 User-agent loads the client, which
redirects it to the authorization server
1a
1b 1c
2 User authenticates into the authorization
server, reviews and grants the client’s
request for permissions
3 Authorization server redirects the user-
agent to the redirect_uri.
2b 2a
2c 2d
3a3b
• Code
• *State
![Page 25: Introduction to OAuthdownload.microsoft.com/download/C/6/0/C60E2BD0-8A7C-479F... · 2018-10-16 · Introduction to OAuth. What drives the need? Versions of OAuth Authentication vs.](https://reader034.fdocuments.net/reader034/viewer/2022043005/5f89b542458a98308002eb45/html5/thumbnails/25.jpg)
Resource
Owner
User
AgentClient Authorization Server
1 User-agent loads the client, which
redirects it to the authorization server
1a
1b 1c
2 User authenticates into the authorization
server, reviews and grants the client’s
request for permissions
3 Authorization server redirects the user-
agent to the redirect_uri.
4 Client sends the authorization code to
the authorization server
2b 2a
2c 2d
3a3b
4
• Grant_type=“authorization_code”
Code
• *Redirect_uri
• *Client_ID
![Page 26: Introduction to OAuthdownload.microsoft.com/download/C/6/0/C60E2BD0-8A7C-479F... · 2018-10-16 · Introduction to OAuth. What drives the need? Versions of OAuth Authentication vs.](https://reader034.fdocuments.net/reader034/viewer/2022043005/5f89b542458a98308002eb45/html5/thumbnails/26.jpg)
Resource
Owner
User
AgentClient Authorization Server
1 User-agent loads the client, which
redirects it to the authorization server
1a
1b 1c
2 User authenticates into the authorization
server, reviews and grants the client’s
request for permissions
3 Authorization server redirects the user-
agent to the redirect_uri.
4 Client sends the authorization code to the
authorization server
5 Authorization server sends the access
token to client
2b 2a
2c 2d
3a3b
4
5
![Page 27: Introduction to OAuthdownload.microsoft.com/download/C/6/0/C60E2BD0-8A7C-479F... · 2018-10-16 · Introduction to OAuth. What drives the need? Versions of OAuth Authentication vs.](https://reader034.fdocuments.net/reader034/viewer/2022043005/5f89b542458a98308002eb45/html5/thumbnails/27.jpg)
Resource
Owner
User
AgentClient Authorization Server
1 User-agent loads the client, which
redirects it to the authorization server
1a
1b 1c
2 User authenticates into the authorization
server, reviews and grants the client’s
request for permissions
3 Authorization server redirects the user-
agent to the redirect_uri.
4 Client sends the authorization code to the
authorization server
5 Authorization server sends the access
token to client
R-1 Client sends refresh token to the
authorization server
2b 2a
2c 2d
3a3b
4
5
R-1
![Page 28: Introduction to OAuthdownload.microsoft.com/download/C/6/0/C60E2BD0-8A7C-479F... · 2018-10-16 · Introduction to OAuth. What drives the need? Versions of OAuth Authentication vs.](https://reader034.fdocuments.net/reader034/viewer/2022043005/5f89b542458a98308002eb45/html5/thumbnails/28.jpg)
Resource
Owner
User
AgentClient Authorization Server
1 User-agent loads the client, which
redirects it to the authorization server
1a
1b 1c
2 User authenticates into the authorization
server, reviews and grants the client’s
request for permissions
3 Authorization server redirects the user-
agent to the redirect_uri.
4 Client sends the authorization code to the
authorization server
5 Authorization server sends the access
token to client
R-1 Client sends refresh token to the
authorization server
2b 2a
2c 2d
3a3b
4
5
R-1
R-2 Client gets back a new access token
R-2
![Page 29: Introduction to OAuthdownload.microsoft.com/download/C/6/0/C60E2BD0-8A7C-479F... · 2018-10-16 · Introduction to OAuth. What drives the need? Versions of OAuth Authentication vs.](https://reader034.fdocuments.net/reader034/viewer/2022043005/5f89b542458a98308002eb45/html5/thumbnails/29.jpg)
User’s pictures
Request for user’s pictures
(includes access token)
Pandaemonium.com/pandafy
Pandafied pics!
ClientResource owner
(user)
![Page 30: Introduction to OAuthdownload.microsoft.com/download/C/6/0/C60E2BD0-8A7C-479F... · 2018-10-16 · Introduction to OAuth. What drives the need? Versions of OAuth Authentication vs.](https://reader034.fdocuments.net/reader034/viewer/2022043005/5f89b542458a98308002eb45/html5/thumbnails/30.jpg)
Redirection-based flow
Does not involve intermediate credentials
Optimized for public clients
Does not support client authentication
Many native (desktop or mobile) clients use this grant
30
![Page 31: Introduction to OAuthdownload.microsoft.com/download/C/6/0/C60E2BD0-8A7C-479F... · 2018-10-16 · Introduction to OAuth. What drives the need? Versions of OAuth Authentication vs.](https://reader034.fdocuments.net/reader034/viewer/2022043005/5f89b542458a98308002eb45/html5/thumbnails/31.jpg)
Resource
Owner
User
AgentClient Authorization Server
1 Client navigates the user-agent to the
authorization server
1a 1b
• Response_type=
• “token”
• Client_id
• *Redirect_uri
• *Scope
• *State
![Page 32: Introduction to OAuthdownload.microsoft.com/download/C/6/0/C60E2BD0-8A7C-479F... · 2018-10-16 · Introduction to OAuth. What drives the need? Versions of OAuth Authentication vs.](https://reader034.fdocuments.net/reader034/viewer/2022043005/5f89b542458a98308002eb45/html5/thumbnails/32.jpg)
Resource
Owner
User
AgentClient Authorization Server
1 Client navigates the user-agent to the
authorization server
2 User authenticates into the authorization
server then reviews and grants the client’s
request for permissions
1a 1b
2b 2a2c 2d
![Page 33: Introduction to OAuthdownload.microsoft.com/download/C/6/0/C60E2BD0-8A7C-479F... · 2018-10-16 · Introduction to OAuth. What drives the need? Versions of OAuth Authentication vs.](https://reader034.fdocuments.net/reader034/viewer/2022043005/5f89b542458a98308002eb45/html5/thumbnails/33.jpg)
Resource
Owner
User
AgentClient Authorization Server
1 Client navigates the user-agent to the
authorization server
2 User authenticates into the authorization
server then reviews and grants the client’s
request for permissions
3 Authorization server redirects the user-
agent to (redirect_uri)#access_token
1a 1b
2b 2a
2c 2d
3
• Token
• Type
• *Expires_in
• *Scope
• *State
![Page 34: Introduction to OAuthdownload.microsoft.com/download/C/6/0/C60E2BD0-8A7C-479F... · 2018-10-16 · Introduction to OAuth. What drives the need? Versions of OAuth Authentication vs.](https://reader034.fdocuments.net/reader034/viewer/2022043005/5f89b542458a98308002eb45/html5/thumbnails/34.jpg)
Resource
Owner
User
AgentClient Authorization Server
1 Client navigates the user-agent to the
authorization server
2 User authenticates into the authorization
server then reviews and grants the client’s
request for permissions
3 Authorization server redirects the user-
agent to (redirect_uri)#access_token
4 Native client detects the redirect and
extracts the access token
1a 1b
4
2b 2a
2c 2d
3
![Page 35: Introduction to OAuthdownload.microsoft.com/download/C/6/0/C60E2BD0-8A7C-479F... · 2018-10-16 · Introduction to OAuth. What drives the need? Versions of OAuth Authentication vs.](https://reader034.fdocuments.net/reader034/viewer/2022043005/5f89b542458a98308002eb45/html5/thumbnails/35.jpg)
35
![Page 36: Introduction to OAuthdownload.microsoft.com/download/C/6/0/C60E2BD0-8A7C-479F... · 2018-10-16 · Introduction to OAuth. What drives the need? Versions of OAuth Authentication vs.](https://reader034.fdocuments.net/reader034/viewer/2022043005/5f89b542458a98308002eb45/html5/thumbnails/36.jpg)
![Page 37: Introduction to OAuthdownload.microsoft.com/download/C/6/0/C60E2BD0-8A7C-479F... · 2018-10-16 · Introduction to OAuth. What drives the need? Versions of OAuth Authentication vs.](https://reader034.fdocuments.net/reader034/viewer/2022043005/5f89b542458a98308002eb45/html5/thumbnails/37.jpg)
![Page 38: Introduction to OAuthdownload.microsoft.com/download/C/6/0/C60E2BD0-8A7C-479F... · 2018-10-16 · Introduction to OAuth. What drives the need? Versions of OAuth Authentication vs.](https://reader034.fdocuments.net/reader034/viewer/2022043005/5f89b542458a98308002eb45/html5/thumbnails/38.jpg)
![Page 39: Introduction to OAuthdownload.microsoft.com/download/C/6/0/C60E2BD0-8A7C-479F... · 2018-10-16 · Introduction to OAuth. What drives the need? Versions of OAuth Authentication vs.](https://reader034.fdocuments.net/reader034/viewer/2022043005/5f89b542458a98308002eb45/html5/thumbnails/39.jpg)
![Page 40: Introduction to OAuthdownload.microsoft.com/download/C/6/0/C60E2BD0-8A7C-479F... · 2018-10-16 · Introduction to OAuth. What drives the need? Versions of OAuth Authentication vs.](https://reader034.fdocuments.net/reader034/viewer/2022043005/5f89b542458a98308002eb45/html5/thumbnails/40.jpg)
40
![Page 41: Introduction to OAuthdownload.microsoft.com/download/C/6/0/C60E2BD0-8A7C-479F... · 2018-10-16 · Introduction to OAuth. What drives the need? Versions of OAuth Authentication vs.](https://reader034.fdocuments.net/reader034/viewer/2022043005/5f89b542458a98308002eb45/html5/thumbnails/41.jpg)
http://tools.ietf.org/html/rfc6749
http://tools.ietf.org/html/rfc6819
http://msdn.microsoft.com/en-us/library/live/hh243647.aspx
http://msdn.microsoft.com/en-us/library/fp142382(v=office.15).aspx
http://openid.net/connect/
![Page 42: Introduction to OAuthdownload.microsoft.com/download/C/6/0/C60E2BD0-8A7C-479F... · 2018-10-16 · Introduction to OAuth. What drives the need? Versions of OAuth Authentication vs.](https://reader034.fdocuments.net/reader034/viewer/2022043005/5f89b542458a98308002eb45/html5/thumbnails/42.jpg)