OAuth

OAuth is an open standard for access delegation, allowing users to grant third-party applications access to their information without sharing their credentials (typically username and password). Instead, OAuth provides tokens that applications can use to access resources on behalf of the user.

OpenID Connect

OpenID Connect (OIDC) is a simple identity layer built on top of OAuth 2.0. It allows clients to verify the identity of end-users based on the authentication performed by an authorization server, as well as to obtain basic profile information about the end-users in an interoperable and REST-like manner.

Getting Started with OAuth and OpenID Connect

Understanding the Terminology

• Resource Owner: The user who authorizes an application to access their account.
• Client: The application that wants to access the user’s account.
• Authorization Server: The server issuing access tokens to the client after successfully authenticating the resource owner and obtaining authorization.
• Resource Server: The server hosting the protected resources (user’s data) that the client wants to access.
• Access Token: The credential used by the application to access the resources.
• ID Token: A JSON Web Token (JWT) that contains information about the end-user and the authentication event, used in OpenID Connect.

Registration of the Client

• Clients need to register with the authorization server, which involves:
  • Providing the application’s details (like name, logo, website).
  • Specifying the Redirect URI where the authorization server will send tokens after authentication.
  • Receiving the Client ID and Client Secret (confidential clients only).

Authorization Grant Types

OAuth defines four grant types for different use cases:

• Authorization Code: Used with server-side applications.
• Implicit: Intended for clients without a server backend.
• Resource Owner Password Credentials: Used when the resource owner has a trust relationship with the client.
• Client Credentials: Used when the client is acting on its own behalf.

Implementing OAuth and OpenID Connect for Authorization

Step 1: Obtaining User Authorization

• The client directs the user to the authorization server with the request parameters:
  • response_type: Determines the authorization processing flow (like code, token).
  • client_id: The public identifier for the client.
  • redirect_uri: Where to send the user after successful authorization.
  • scope: The level of access required.
  • state: An unguessable random value to prevent CSRF attacks.

Step 2: Authentication and Authorization

• The user authenticates with the authorization server and grants the client permission to access their resources.

Step 3: Receiving the Authorization Code

• For the Authorization Code grant type, the server sends the code to the redirect URI provided by the client.

Step 4: Exchanging the Authorization Code for an Access Token

• The client exchanges the authorization code for an access token by calling the authorization server’s token endpoint.

Step 5: Accessing the Resource

• The client uses the access token to access the resource server’s resources on behalf of the user.

Ensuring Security in OAuth and OpenID Connect

Token Security

• Access Token Lifespan: Access tokens should be short-lived to reduce the risk of unauthorized use.
• Refresh Tokens: Issued for longer-term access; used to obtain new access tokens.
• HTTPS: Always use secure connections to transmit tokens.

Client Authentication

• Confidential clients must authenticate to the token endpoint using one of the allowed methods.
• Public clients must use other means like PKCE (Proof Key for Code Exchange) to ensure security.

OpenID Connect Specifics

• Use response_type = code id_token for authentication and receiving an ID Token alongside the code.
• Validate ID Tokens to verify the user’s identity.