why? Give an app access to a resource managed by someone else, without giving the app your password. A valet key for the web Allen I.

Size: px

Start display at page:

Download "why? Give an app access to a resource managed by someone else, without giving the app your password. A valet key for the web Allen I."

Nancy O’Brien’
6 years ago
Views:

1 Give an app access to a resource managed by someone else, without giving the app your password. why? Allen I. Holub Holub Associates tells the A valet key for the web Resource Owner Access the ignition, but not the trunk. Authorization Server to allow the Access for a short time. Client to access data on by presenting Resource Server Access token. 4

2 1 Digitally signed (by you) Normal Flow (preserved in OAuth 2) redirect

Access tokens have a limited lifetime OAuth 2 OAuth 1 + TLS Client gets a replacement by presenting a Refresh Token to

architecture 9 10 9 10 Insecure Houston, We have a problem. IETF Draft: OAuth 2.

gl/y0bvln) 52 Threats documented Diffuse Many parts deliberately open to interpretation Enterprise (not web) focused

3 Access tokens have a limited lifetime OAuth 2 OAuth 1 + TLS Client gets a replacement by presenting a Refresh Token to the Authorization Server Good for 1 Access Token No digital signing required Not backwards compatible But, similar architecture Insecure Houston, We have a problem. IETF Draft: OAuth 2.0 Threat model and Security Considerations ( 52 Threats documented Diffuse Many parts deliberately open to interpretation Enterprise (not web) focused Google requires it Eran Lehav-Hammer (invented OAuth): Interoperability is impossible All vendors have proprietary variants. 11 He withdrew his name from the standard after 31 drafts got nowhere

Flows Web Server (next slide) User-Agent clients inside a web browser/javascript Username/Password really defeats the purpose Assertion via SAML

authorize request: Auth Server Request access Authenticate & authorize client authorization code Client ID Exchange code for tokens op that needs

4 Flows Web Server (next slide) User-Agent clients inside a web browser/javascript Username/Password really defeats the purpose Assertion via SAML assertion Client Credentials when client owns the resource Use a vendorsupplied implementation Web-server flow Typical authenticate/ authorize request: Auth Server Request access Authenticate & authorize client authorization code Client ID Exchange code for tokens op that needs resource Go here after permission from Resource Owner granted. Request resource {datatype: contents} Resource Server Refresh Access Token Client

Server returns data $ curl https://www.googleapis.

5 On success, auth server responds to: Use the auth code to request tokens Auth code from previous step. with authorization code: which returns Request data from Request Server Request Server returns data $ curl H Authorization: OAuth ya29.ahes6zrtj1gnxaby81es- p_ypwwnbafrvbyvsyj2hzjfjhu' Access token

21 22 21 22 Installed-app flow (same as web

6 If request refused, refresh access token NONE OF THIS IS SECURE IF YOU DON T USE TLS (HTTPS) Installed-app flow (same as web application)

7 Client-side (Javascript) app Limited-input device Service accounts (owned by client app) Static IP required Set up to test

8 Set up to test (2) accounts/docs/oauth Developer s Console console.developers.google.com Cocoa 31 JavaScript

33 GenericUrl url = new GenericUrl(req.getRequestURL().toString()); 2014. url.setrawpath("/oauth2callback"); Allen I. Holub return url.

9 33 GenericUrl url = new GenericUrl(req.getRequestURL().toString()); url.setrawpath("/oauth2callback"); Allen I. Holub return url.build(); protected String getuserid(httpservletrequest req) throws ServletException, IOException { // return user ID } } public class CalendarServletCallbackSample extends AbstractAuthorizationCodeCallbackServlet protected void onsuccess(httpservletrequest req, HttpServletResponse resp, Credential credential) throws ServletException, IOException { resp.sendredirect("/"); protected void onerror( HttpServletRequest req, HttpServletResponse resp, AuthorizationCodeResponseUrl errorresponse) throws ServletException, IOException { // handle error protected String getredirecturi(httpservletrequest req) throws ServletException, IOException { 35 public class CalendarServletSample extends AbstractAuthorizationCodeServlet protected void doget(httpservletrequest request, HttpServletResponse response) throws IOException { // do stuff protected String getredirecturi(httpservletrequest req) throws ServletException, IOException { GenericUrl url = new GenericUrl(req.getRequestURL().toString()); url.setrawpath("/oauth2callback"); return url.build(); protected AuthorizationCodeFlow initializeflow() throws IOException { return new GoogleAuthorizationCodeFlow.Builder(new NetHttpTransport(), new JacksonFactory(), "[[ENTER YOUR CLIENT ID]]", "[[ENTER YOUR CLIENT SECRET]]", Collections.singleton(CalendarScopes.CALENDAR)).setCredentialStore( new JdoCredentialStore( JDOHelper.getPersistenceManagerFactory("transactions-optional"))).build(); protected String getuserid(httpservletrequest req) throws ServletException, IOException { Allen I. Holub // return user ID protected String getredirecturi(httpservletrequest req) throws ServletException, IOException { GenericUrl url = new GenericUrl(req.getRequestURL().toString()); url.setrawpath("/oauth2callback"); return url.build(); protected AuthorizationCodeFlow initializeflow() throws IOException { return new GoogleAuthorizationCodeFlow.Builder( new NetHttpTransport(), new JacksonFactory(), "[[ENTER YOUR CLIENT ID]]", "[[ENTER YOUR CLIENT SECRET]]", Collections.singleton(CalendarScopes.CALENDAR)).setCredentialStore( new JdoCredentialStore( JDOHelper.getPersistenceManagerFactory("transactions-optional"))).build(); protected String getuserid(httpservletrequest req) throws ServletException, IOException { // return user ID } } 36

10 get from:

11 OAUTH 1.0 (RFC 5849) OAUTH 2.0 (RFC 6749) OAUTH 2.0 Threat Model Various implementations: 41? Allen Allen I. Holub

Authentication in the Cloud. Stefan Seelmann

Authentication in the Cloud. Stefan Seelmann Authentication in the Cloud Stefan Seelmann Agenda Use Cases View Points Existing Solutions Upcoming Solutions Use Cases End user needs login to a site or service End user wants to share access to resources