1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
|
# Introduction
* OAuth 2.0: Something I implemented in a previous job.
* A common, almost fundamental protocol on the web, especially
for APIs.
- See: OKAPI
* Solves a common problem: letting one site act on behalf of an end
user on another site.
-----------------------------------------------------------------------------
# Basic concepts
* Identification "who are you?"
- all the relevant things others need to know about you
- name, date of birth, contact info, DNS sample, ...
- often just "this user account on this service"
* Authentication: "how do I know it's really you?"
- something you know, something you have, something you are
- passwords
- hardware security tokens
- biometrics
- possibly several, depending
* Authorization: "what should I allow you to do?"
- who said you can?
-----------------------------------------------------------------------------
# What OAuth2 is for?
* Client authorization by end-user.
* NOT end-user identification.
* NOT end-user authentication.
* NOT end-user authorization.
* NOT client identification.
* NOT client authentication.
-----------------------------------------------------------------------------
I hereby authorize this specific third party to access these bits of
my data stored on this particular service. The third party has only
specific, limited access, possibly for a limited time. I may withdraw
my authorization at any time.
-----------------------------------------------------------------------------
# Example
* Alice uses an email service, AMail.
* Alice wants to have a book printed with all her emails. A
beautifully typeset, illustrated, color-printed, leather-bound, hard
cover book. An heirloom.
* Book printing service, MailBooks, can do this, but needs to access
AMail to download all of Alice's emails.
* How can this be done securely?
-----------------------------------------------------------------------------
# Not this way
Alice gives MailBooks her username and password at AMail.
MailBooks solemnly promises to not delete anything and to not send any
mail, and to forget the password after they've got what they need for
producing the book.
Yeah right.
-----------------------------------------------------------------------------
# Not this way either
MailBooks and AMail have a special agreement.
AMail will give all the emails MailBooks asks for. MailBooks promises
to only ask for email of people who say they want a book. MailBooks
asks its customers to not lie about who they are.
There is no way in which this might go badly.
-----------------------------------------------------------------------------
# No, just no
Alice forwards each email to MailBooks. All 1.3 million of them.
-----------------------------------------------------------------------------
# OAuth2: Overview
* Alice asks MailBooks for a book.
* MailBooks tells her to authorize them on AMail.
* Alice logs into AMail and clicks a button to authorize MailBooks.
AMail creates an **access token**.
* Alice gives the access token to MailBooks.
* MailBooks gives the access token to AMail and says it wants a copy
of every one of Alice's email.
* AMail checks the token and responds with all a copy of all the emails.
* MailBooks prints and sends the book to Alice.
-----------------------------------------------------------------------------
~~~plantuml
@startuml
actor Alice
entity "Book service" as Booksite
database "Email service" as Email
Alice -> Booksite: Want book!
Booksite -> Email: May I get emails?
Email -> Alice: OK to give emails to Booksite?
Alice -> Email: Sure!
Email -> Booksite: Have an access token
Booksite -> Email: Emails please
Booksite -> Alice: Your book, bitte
@enduml
~~~
-----------------------------------------------------------------------------
# Details
* HTTPS: always when credentials or tokens are transmitted
* access and **refresh tokens**: may be opaque to clients
- but JWT is common
* tokens are for a specific client and service
* tokens specify a **scope**: what operations they allow
* tokens expire → refresh tokens
* endpoint discovery: originally unspecified
-----------------------------------------------------------------------------
# Transaction 1: four specified grant variants
* authorization code: OKish, but security can be improved
* a lot of HTTP redirects
* client credentials: bots without end users
* implicit: don't use, trusts browser too much
* resource owner password credentials: NO, JUST NO!
* any of these may of course fail
-----------------------------------------------------------------------------
# Transaction 2: use access token
* send request + token to resource provider (server)
-----------------------------------------------------------------------------
# Transaction 3: get new access token
* When access token expires.
* Or when a client wants to give another client an access token,
possibly with less scope.
-----------------------------------------------------------------------------
# SEE ALSO
* [RFC 6749](https://tools.ietf.org/html/rfc6749)
* [OAuth website](https://oauth.net/)
* [Yuck](https://yuck.liw.fi/)
-----------------------------------------------------------------------------
# Legalese
Copyright 2020 Wikimedia Foundation
This content is licensed under the Creative Commons
Attribution-ShareAlike 4.0 International ([CC BY-SA 4.0][]) licence.
[CC BY-SA 4.0]: https://creativecommons.org/licenses/by-sa/4.0/
---
title: "The OAuth 2.0 Protocol"
subtitle: "EngProd paper club: RFC 6749"
author: "Lars Wirzenius"
date: "2020-12-07"
...
|
