OpenID Connect - a simple[sic] single sign-on & identity layer on top of OAuth 2.0

OpenID Connect

a simple[sic] single sign-on & identity layer on top of OAuth 2.0

Brian Campbell@__b_c

Copyright © 2014 Brian Campbell. All rights reserved.

Copyright © 2014 Brian Campbell. All rights reserved. 2

Agenda

• Introductions• Framing the Problem• OpenID Connect as an Emergent Solution • Nuts & Bolts: The Basic Client Profile• Random Thoughts


Who Dat?Brian CampbellSome Meaningless Title & 10+ years @

Used to write a lot of code Now active in standards development

Identity is ubiquitous. Regardless of the kind of applications you develop you will, at some point, almost certainly have to deal with identifying users of the app. Yet it's seldom a central part of the app’s value proposition and rarely a core competency for developers. Wouldn’t it be nice to outsource user authentication and free yourself from the liability and complexity of storing and managing passwords? OpenID Connect, just ratified earlier this year and backed by some big industry names, is emerging as the go to standard way to do exactly that. Connect allows you to easily and securely get an answer to the question: “What is the identity of the person currently using this browser or native app?” Unlike some of it’s predecessors, however, Connect has roots spanning the consumer, SaaS and enterprise space and is better suited to serve a diverse set of deployments. Come find out more about Connect in this talk from a seasoned veteran of the prestigious basement conference rooms at GlueCon.

Cardboard box


Speaker Credentials


Speaker Credentials


Speaker Credentials

Prominently mentioned on the second to last page that nobody will ever read just before the copyright notices


Agenda



Passwords are Broken For Users

Death by a Thousand Passwordstrue story: “holyfucknotanotherfuckingpassword1”

PASSWORD FATIGUE


Passwords are Broken For Users

What?

A Well Regarded Fortune 500 Financial Services Company


Passwords also Broken for Service Providers

• Hell on user registration conversion rates

• Managing passwords is hard– Just ask Adobe or LinkedIn

or Kickstarter or…


Agenda



Introducing OpenID Connect• Easily and securely get an answer to the

question: “What is the identity of the person currently using this browser or native app?”– Without taking on the responsibility of storing and

managing passwords, which is nice• Built on top of OAuth 2.0 using familiar and

widely available stuff like JSON and HTTP• Adds an ID Token (JWT) for user authentication

to the client• API access and SSO together


Unlike Predecessors

Connect isn’t broken for mobile


OAuth 2.0 In A Nutshell

Client

ResourceServer

Get an access token

Use an access token

AuthorizationServer

Authorization Endpoint

Token Endpoint

Important Stuff

Where the magic

happens


OAuth 2.0

JOSE WebFinger

OpenIDConnect


OpenID Connect is built on OAuth 2.0

Discovery

ClientRelying Party

ResourceServer

Get an access token

& an ID Token (JWT)

Use an access token

AuthorizationServer

Identity Provider orIDP or

OpenID Provider orOP

Authorization Endpoint

Token Endpoint

Important Stuff

Userinfo Endpoint

Registration Endpoint

JWKS Endpoint

JWKS Endpoint

Validate (JWT)

ID Token

/.well-known /webfinger /openid-configuration

Check Session IFrame

End Session Endpoint


Didn’t Someone Say “Simple”?• It wasn’t me

• It’s not simple, it’s complicated• But the burden of complexity has been shifted

to the Identity Provider, where it’s more appropriate

• Many deployments can be à la carte

Mr. Boombastichttps://www.flickr.com/photos/67589493@N00/166195826

(cropped)https://creativecommons.org/licenses/by/2.0/

https://www.flickr.com/photos/67589493@N00/166195826

https://creativecommons.org/licenses/by/2.0/


Agenda



Basic Client• OpenID Connect Basic Client Implementer's

Guide 1.0 – http://openid.net/specs/openid-connect-basic-1_0.html

• “a subset of the OpenID Connect Core 1.0 specification that is designed to be easy to read and implement for basic Web-based Relying Parties using the OAuth Authorization Code Flow.”

http://openid.net/specs/openid-connect-basic-1_0.html


Basic Client Flow

End-User / Browser

Client Auth Server

Redirect w/ Authentication Request

Authentication Request


Basic Client Flow

End-User / Browser

Client Auth Server

https://connect-interop.pinglabs.org:9031/as/authorization.oauth2?client_id=some-client-identifier&response_type=code&scope=openid profile email address phone&state=meh234&redirect_uri=https://client.example.io/cb



not encoded for readability


Basic Client Flow

End-User / Browser

Client Auth Server



Authenticate End-User


Basic Client Flow

End-User / Browser

Client Auth Server





Basic Client Flow

End-User / Browser

Client Auth Server




Obtain User Consent


Basic Client Flow

End-User / Browser

Client Auth Server




Obtain User Consent


Basic Client Flow

End-User / Browser

Client Auth Server




Obtain User Consent

Redirect w/ Authentication Response

Authentication Response w/ code


Basic Client Flow

End-User / Browser

Client Auth Server




Obtain User Consent


Authentication Response w/ code

https://client.example.io/cb?state=meh234&code=JbXAZUzro_ka3htpQSePwxOMjTfQX8RxmRELgiP1


Basic Client Flow

End-User / Browser

Client Auth Server




Obtain User Consent


Authentication Response w/ codeToken Request w/ code


Basic Client Flow

End-User / Browser

Client Auth Server




Obtain User Consent



POST /as/token.oauth2 HTTP/1.1Host: connect-interop.pinglabs.org:9031Content-Length: 185Content-Type: application/x-www-form-urlencoded

client_id=some-client-identifier&grant_type=authorization_code&client_secret=super-duper-password&redirect_uri=https://client.example.io/cb&code=JbXAZUzro_ka3htpQSePwxOMjTfQX8RxmRELgiP1

not encoded for readability


Basic Client Flow

End-User / Browser

Client Auth Server




Obtain User Consent



Token Response w/ access & ID token


Basic Client Flow

End-User / Browser


Client Auth Server




Obtain User Consent



HTTP/1.1 200 OKDate: Tue, 13 May 2014 15:43:14 GMTCache-Control: no-cache, no-storePragma: no-cachemax-age: Thu, 01 Jan 1970 00:00:00 GMTContent-Type: application/json;charset=UTF-8Expires: Thu, 01 Jan 1970 00:00:00 GMTTransfer-Encoding: chunked

{"token_type":"Bearer","expires_in":600,"id_token":"eyJhbGciOiJub25lIn0.eyJzdWIiOiIxMDAxIiwiYXVkIjoic29tZS1jbGllbnQtaWRlbnRpZmllciIsImp0aSI6Ijc2UnJHdkM1bDNRT1BPMDVwTGpVdmEiLCJpc3MiOiJodHRwczpcL1wvY29ubmVjdC1pbnRlcm9wLnBpbmdsYWJzLm9yZzo5MDMxIiwiaWF0IjoxMzk5OTk1Nzg1LCJleHAiOjEzOTk5OTYzODV9.","access_token":"zfrQZYtamGHS6ZYXdSV4Yo"}



Basic Client Flow

End-User / Browser

Client Auth Server




Obtain User Consent



eyJhbGciOiJub25lIn0.eyJzdWIiOiIxMDAxIiwiYXVkIjoic29tZS1jbGllbnQtaWRlbnRpZmllciIsImp0aSI6Ijc2UnJHdkM1bDNRT1BPMDVwTGpVdmEiLCJpc3MiOiJodHRwczpcL1wvY29ubmVjdC1pbnRlcm9wLnBpbmdsYWJzLm9yZzo5MDMxIiwiaWF0IjoxMzk5OTk1Nzg1LCJleHAiOjEzOTk5OTYzODV9.

{"alg":"none”}

{"sub":"1001", "aud":"some-client-identifier", "jti":"76RrGvC5l3QOPO05pLjUva", "iss":"https:\/\/connect-interop.pinglabs.org:9031", "iat":1399995785, "exp":1399996385}


Basic Client Flow

End-User / Browser

Client Auth Server




Obtain User Consent




User Info Request w/ access token



Basic Client Flow

End-User / Browser

Client Auth Server




Obtain User Consent



GET /idp/userinfo.openid HTTP/1.1Host: connect-interop.pinglabs.org:9031Accept: */*Authorization: Bearer zfrQZYtamGHS6ZYXdSV4Yo



Basic Client Flow

End-User / Browser

Client Auth Server




Obtain User Consent




User Info Response





Basic Client Flow

End-User / Browser

Client Auth Server




Obtain User Consent



User Info Response

HTTP/1.1 200 OKDate: Tue, 13 May 2014 15:44:13 GMTContent-Type: application/json;charset=UTF-8

{"sub": "1001", "name": "Joe Doe", "given_name": "Joe", "family_name": "Doe", "preferred_username": "joe", "email": "[email protected]", "picture": "http://farm8.staticflickr.com/7224/7395022014_1f6f3b33c8_m.jpg", "address":{"formatted":"1234 South North Street, Amherst, MA 01002"}, "phone_number":"+1 (413) 867-5309"}


That was Simple?• There are a lot of lines…

• But from the Client’s perspective– Send the user off somewhere – Wait for them to show up on a callback– Make two simple HTTPS calls and validate some

data – Done


Agenda



It’s Not All Rainbows & Unicorns• SAML’s IDP initiated POST is easily the most

successful SSO deployment for the enterprise market

• Some impedance mismatch as Connect doesn’t have straightforward equivalents


Tweet Bait

https://twitter.com/cloud_opinion/status/459481058480648193

one picture

of a goat


I’m Done.

Software

OpenID Connect - a simple[sic] single sign-on & identity layer on top of OAuth 2.0