Download - The Last Authentication System You Will Ever Write

The Last Authentication System You Will Ever Write

Jason Austin - @jason_austin - [email protected]

Thursday, May 26, 2011

mailto:[email protected]


A Quick Rundown

• Authentication Basics

• Pros/Cons of offloading

• Authentication Mechanisms

• Authentication Providers

• Implementation


Authentication Basics

flickr - @digiart2001

Authentication !=

Authorization

Who you are vs.

what rights you have


Setting Up An Auth System

• Signup

• Confirmation

• Authenticate (Username / Password)

• Password Retrieval / Reset

• Password Change


Security Requirements

• Secure Transactions

• Salting/Hashing Passwords

• Storing Passwords

• Password Strength Requirements

• Policies surrounding username selections


User Impact

• Signup process

• Name

• Password (And Confirm)

• Email Address

• Yet another set of credentials


Offloading Authentication

flickr - @sbisson


What is Offloading?

• Authentication via third trusted party

• User creates an account there (or likely already has one)

• They manage passwords and usernames

• Host application passes user to authentication provider

• No passwords pass over your wire


Why Offload?

• Dirty work is done for you

• No Passwords. Ever. None.

• No Username Selections

• Implementation is quick and easy

• Signup is fast


Effectiveness

• Quick Conversion

• Personal Information

• Demographic Information


Downsides

• Indentured to a provider

• Require a third party for a critical aspect of your application


Who To Use?


Finding a Provider

• Reliability

• Support

• Trust from users

• Usage

• Longevity


Make A Choice

• Pick the right service for your audience

• Choose multiple services


Getting StartedThursday, May 26, 2011

First Step

• Getting to know the technologies

• OpenID

• OAuth


OpenID

• One login, multiple sites

• Decentralized

• URI-based. EX: jfaustin.myopenid.com

• Service provided by anyone


OpenID Workflow


OpenID

• Hasn’t really caught on

• Thought of as “geek speak”

• Service providers include

• Google

• Yahoo

• Many more...


OAuth

• Open standard for access delegation

• With authentication, provides ability for SSO

• Valet key to the internet


OAuth Players

• Service Provider (Server)- Has the information you want

• Consumer (Client) - Wants the information from the Service Provider

• User (Resource Owner) - Can grant access to the Consumer to acquire information about your account from the Service Provider


OAuth

• Technology behind authentication from

• Facebook

• Yahoo!

• Twitter


Sign in with Twitter


Get Started

• Register your app with Twitter

• https://dev.twitter.com/apps/new

• Add some UI to your app

• Choose an OAuth lib to help


https://dev.twitter.com/apps/new

https://dev.twitter.com/apps/new

OAuth Libraries

• oauth-phphttp://code.google.com/p/oauth-php/

• Zend_Oauthhttp://framework.zend.com/manual/en/zend.oauth.introduction.html

• OAuth PECL packagehttp://pecl.php.net/package/oauth

• CakePHP OAuth Packagehttp://code.42dh.com/oauth/


http://code.google.com/p/oauth-php/

http://code.google.com/p/oauth-php/

http://framework.zend.com/manual/en/zend.oauth.introduction.html




http://pecl.php.net/package/oauth

http://pecl.php.net/package/oauth

http://code.42dh.com/oauth/

http://code.42dh.com/oauth/

Files Needed

index.php auth.php callback.php

* Need a OAuth library. We’re going to use ZF


<?php// index.php

if (isset($_SESSION['auth'])) { echo "Logged in"; echo "<br><br><pre>"; print_r($_SESSION['auth']); echo "</pre>"; echo "<a href='logout.php'>Logout</a>";} else { echo "Not logged in"; echo "<br><br>"; echo "<a href='auth.php'>Sign in to twitter</a>";}

Logging In


<?php// auth.php

if (isset($_SESSION['auth'])) { echo "already logged in"; die();}

$options = array( 'consumerKey' => 'asdfgawe23aewvserg43tg', 'consumerSecret' => 'asdf34visnerfg9j0ae49gj09srjg9ae', 'callbackUrl' => 'http://pintlabs.com/demo/callback.php', 'siteUrl' => 'http://twitter.com/oauth');

require_once 'Zend/Oauth/Consumer.php';$consumer = new Zend_Oauth_Consumer($options);

$token = $consumer->getRequestToken();

$_SESSION['requestToken'] = serialize($token); $consumer->redirect();

Authentication


http://jurassic.unity.ncsu.edu/test/auth/callback'

http://jurassic.unity.ncsu.edu/test/auth/callback'

http://twitter.com/oauth'

http://twitter.com/oauth'

<?php// callback.php

if (!isset($_GET['oauth_token'])) { die("oauth_token not set");}

$response = array( 'oauth_token' => $_GET['oauth_token'], 'oauth_verifier' => $_GET['oauth_verifier'],);

// same options as auth.php$consumer = new Zend_Oauth_Consumer($options);

$requestToken = unserialize($_SESSION['requestToken']);

$accessToken = $consumer->getAccessToken($response, $requestToken);

unset($_SESSION['requestToken']);

parse_str($accessToken->getResponse()->getBody(), $params);

$_SESSION['auth'] = $params;

Receive the Callback


Best PracticesThursday, May 26, 2011

A Few Things To Remember...

• What if the external key changes?

• Changed OpenID URL

• Changed Twitter ID

• Multiple accounts from the same user


Account Management

• Have an internal application account id

• Link external accounts to internal id

• Allow management of external authentication sources by the user


Have A Backup Plan

• Downtime

• Removal of service

• Change in service


Questions?

http://joind.in/3431

Jason Austin - @jason_austin - [email protected]

Code Available at http://github.com/jfaustin/tek11-twitter-auth






http://github.com/jfaustin/tek11-twitter-auth

http://github.com/jfaustin/tek11-twitter-auth