Secure Your Apis & Microservices with Oauth & Openid Connect

Secure your APIs & Microservices with OAuth & OpenID Connect

By Travis Spencer, CEO @travisspencer, @curityio

ü All API Conferences Austin API Summit June 11 – 13 | Austin, Texas ü API Community ü Active blogosphere 2018 Platform Summit October 22 - 24 | Stockholm, Sweden API Security == API Keys

• Problem Solved!

• Revocable, non-expiring, bearer access tokens • Symmetric keys • Passwords!

• Problem solved for real this time?

Not that easy! Sorry L

Enterprise Security API Security Mobile Security

Mobile Security

MDM MAM

Enterprise AuthZ API Security Security

Authentication U2F

Provisioning SCIM

Identities JSON Identity Suite

Federation OpenID Connect

Delegated Access OAuth 2 Authorization

• OAuth 2 is the new protocol of protocols • Used as the base of other specifications • OpenID Connect, UMA, HEART, etc. • Addresses some important requirements • Delegated access • No password sharing • Revocation of access

1. Resource Owner (RO) 2. Client 3. Authorization Server (AS) Get a token 4. Resource Server (RS) (i.e., API)

Use a token

Request Access Login Consent

User is redirected to OAuth server

APIs & microservices

User logs in and delegates access

APIs & microservices

Short-lived access code is issued to client

APIs & microservices

Code is exchanged for an access token

APIs & microservices

Access token can be used to call APIs

APIs & microservices

• Like permissions • Scopes specify extent of tokens’ usefulness • Listed on consent UI (if shown) • No standardized scopes

Access Tokens Refresh Tokens

Like a session Like a Password Used to secure API calls Used to get new access tokens

Bearer Holder of Key $

Bearer tokens are like HoK tokens are like cash credit cards

• WS-Security & SAML • Custom • Home-grown • Oracle Access Manager • SiteMinder • CBOR Web Tokens (CWT) • JWT

• Pronounced like the English word “jot” • Lightweight tokens passed in HTTP headers & query strings • Encoded as JSON • Compact • Encrypted, signed, or neither • Not the only kind of token allowed by OAuth

By Value By Reference

User attributes are in User attributes are the token referenced by an identifier

Not for authentication

Not for federation

Not really for authorization

For delegation

• Next generation federation • Client & API receive tokens protocol • User info endpoint provided for • Based on OAuth 2 client to get user data • Made for mobile • Not backward compatible

OAuth AS / OpenID RP / Client Provider Access token & ID token User info

GetSend user code info tousing get accessaccess tokentoken Request login, providing “openid” Check audience scope & user info restriction of ID token Access code scopes

Browser

• Access token is for API • ID token is for client • ID token provides client with info about • Intended client recipient • Username • Credential used to login • Issuer of token • Expiration time

• Token issuance and user discovery endpoint • Authenticate using access token issued by OpenID Provider • Output depends on requested and authorized scopes • sub claim must match sub claim in ID token

Component A Component C

Component B Component D

User repository

By Value By Reference

User attributes are in User attributes are the token referenced by an identifier

Contains NO information outside the network

Contains ALL necessary information

By Reference By Value API Firewall / Reverse Proxy

APIs & Services

Inside the network Outside the network

By Reference By Value API Firewall / Reverse Proxy

APIs & Services

Outside the network Inside the network

• Blog posts § Videos • bit.ly/oauth-deep-dive § bit.ly/oauth-in-depth • bit.ly/4-api-security-defenses § bit.ly/micro-services-security • bit.ly/building-secure-api § bit.ly/building-secure-api-video • bit.ly/right-api-armor § Whitepaper at our booth • https://bit.ly/2qn8Jj4 § https://nordicapis.com/api- insights/security/

• API security > API keys & OAuth • OAuth 2 fundamentals • Token types • Profiles • Passing tokens • Building OpenID Connect on OAuth • Using those with microservices & for user-based delegation