This document discusses authentication and authorization standards including OAuth 2.0, OpenID Connect, and IdentityServer 4. It provides an overview of these specifications, how they relate, and how IdentityServer 4 can be used to implement authentication and authorization in ASP.NET Core applications using standards-based flows like authorization code flow and hybrid flow. Code samples and diagrams are included to demonstrate concepts like identity tokens, access tokens, and the roles of the authorization server and resource server.

1. https://rocksolidknowledge.com
© 2017 Rock Solid Knowledge
Scott Brady - @scottbrady91
Identity & Access Control Lead @ Rock Solid Knowledge
https://rocksolidknowledge.com
© 2017 Rock Solid Knowledge
Modern Authentication for ASP.NET
Core with IdentityServer 4

2. Scott Brady & Rock Solid Knowledge
● Identity & Access Control Lead @ Rock Solid Knowledge
○ scottbrady91.com
○ @scottbrady91
● European Commercial Partners for the IdentityServer OSS Project
○ AdminUI
○ SAML2P
○ IdentityExpress
● Umbraco Gold Partner
● Xamarin Authorized Consulting Partner

3. Agenda
● OAuth 2.0 Recap
● OpenID Connect 1.0
● IdentityServer 4
No GIFs...

4. .NET Core 1.1 SDK

5. Why?
● Things change…
● Modern Devices
○ Mobile
○ Client-side SPA
○ Microservices

6. Layers
User Store Authentication Authorization

7. OAuth 2.0
● Authorization Protocol
○ Delegation Protocol
● Designed for HTTP APIs
● Scoped Access
● User Authentication & Client Authentication
scottbrady91.com/OAuth/The-Wrong-Ways-to-Protect-an-API

8. Resource Owner
(User)
Authorization Server
Client Application
Protected Resource
(HTTP API)
Authorization
Request
Authorization
Grant
Authorization
Grant
Access
Token
Request + Access Token
Response

9. The Problems with OAuth
● Specification Issues
● Token Type
● OAuth != Authentication

10. OpenID Connect
● OAuth 2.0 + Authentication
● Formalises OAuth
○ Standard Token Type
○ Standard Cryptography
○ Standard Validation
● Authorization Server becomes an Identity provider
○ Identity Resource
○ Identity Tokens
● Designed to be simple for the client

11. OpenID Connect

12. OpenID Connect Core Endpoints
Authorization Token User Info

13. OpenID Connect - Implicit Flow
https://localhost:5000/callback
#id_token=2YotnFZFEjr1zCsicMWpAA
&state=123abc
/authorize?client_id=oauth_client
&response_type=id_token
&scope=openid profile email
&redirect_uri=https://localhost:5000/callback
&state=123abc
&nonce=789xyz

14. Demo!

15. Identity Tokens
● JSON Web Tokens (JWT)
○ Structured Data
○ Verifiable Digital Signature
● Represents the authentication event

16. Identity Token
● Used to represent an
authenticated user
● Meant for the client application
● Short lived
eyJhbGciOiJSUzI1NiIsImtpZCI6IjJhYTE3OWNhZGI2NmYwOTh
hNDQ5MDk1MzU0NWY3MDE2IiwidHlwIjoiSldUIn0.eyJuYmYiOj
E1MDUzMjg1NDMsImV4cCI6MTUwNTMyODg0MywiaXNzIjoiaH
R0cDovL2xvY2FsaG9zdDo1MDAwIiwiYXVkIjoicHJvZ19uZXQiL
CJub25jZSI6IjYzNjQwOTI1MzM5ODcyOTgwOC5aVFEwTkRoa0
1qa3RPV1ZpWlMwME1EaG1MV0ZpTXpRdFptUmtaRFF6TkRV
ME0yTTNPRFU0TW1Zd1lURXRORFl3T0MwME1EQTVMV0V6
TlRFdE9UWmlNekU1Wmpjd05EaGkiLCJpYXQiOjE1MDUzMjg1
NDMsInNpZCI6IjM5NjRkZDg0MjZmMjE4MGY5MzkzOTEzNDg4
NTllMGQ0Iiwic3ViIjoiODg0MjExMTMiLCJhdXRoX3RpbWUiOjE1
MDUzMjg1NDMsImlkcCI6ImxvY2FsIiwibmFtZSI6IkJvYiBTbWl0a
CIsImdpdmVuX25hbWUiOiJCb2IiLCJmYW1pbHlfbmFtZSI6IlNta
XRoIiwid2Vic2l0ZSI6Imh0dHA6Ly9ib2IuY29tIiwiYW1yIjpbInB3Z
CJdfQ.BP4-
TV9zlTNPlM24QyILjnJxY0SJVPuBVdt12urGaezX8LiRZ8JQO1N
xqiWVeEcZ8y5Vo1NVzZy2U8SrYRlHjG11Cg2UMmqqFxNFXTp
urevNn-2QnD9QWRS00inuRZc-TmI2HeAvaVF-
EerpEQY6Dnxw7Q4l0sI-veIxwKXKr2905UVOvj7D4wwGUF-
lFMqaMI0wRPPyd5R18w38SHkzvbqO9LEO0gqTIneJPnRIhSRp
iHweJW85g1WBnrMsikxVdCzEIGPbmJR-
Khe8e2YUupB5vUAQzwHJmaieM89ikJde9G5T-
nzzDSU4AzMdLDjlBkZyn1wPMq63bM9GFsa5RA

17. Identity Token
● Used to represent an
authenticated user
● Meant for the client application
● Short lived
{
"alg": "RS256",
"kid": "2aa179cadb66f098a4490953545f7016",
"typ": "JWT"
}
{
"nbf": 1505328543,
"exp": 1505328843,
"iss": "http://localhost:5000",
"aud": "prog_net",
"nonce": "636409253398729808.ZTQ0NDhkMjktOWViZS00Msdfji",
"iat": 1505328543,
"sid": "3964dd8426f2180f939391348859e0d4",
"sub": "88421113",
"auth_time": 1505328543,
"idp": "local",
"name": "Bob Smith",
"given_name": "Bob",
"family_name": "Smith",
"website": "http://bob.com",
"amr": [
"pwd"
]
}

18. Identity != Permissions

19. Identity

20. OpenID Connect Identity Scopes
openid
sub
profile
name, family_name, given_name, middle_name, nickname,
preferred_username, profile, picture, website, gender, birthdate, zoneinfo,
locale, updated_at
email
email, email_verified
address
address
phone
phone_number, phone_number_verified

21. {
"code": "asdhjbpeivdafgj",
"state": "123abc"
}
OpenID Connect - Authorization Code Flow
/authorize?client_id=oauth_client
&response_type=code
&scope=openid profile api1
&redirect_uri=https://localhost:5000/callback
&state=123abc
&nonce=789xyz

22. OpenID Connect - Authorization Code Flow
POST /token {
grant_type=authorization_code
&client_id=oauth_client
&client_secret=supersecret
&code=asdhjbpeivdafgj
&redirect_uri=https://localhost:5000/callback
}
{
"access_token": "2YotnFZFEjr1zCsicMWpAA",
"token_type": "Bearer",
"expires_in": 3600,
"id_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6IjdlOW..."
}

23. OpenID Connect - Implicit Flow
https://localhost:5000/callback
#id_token=eyJhbGciOiJSUzI1NiIsImtpZCI6IjdlOW...
&access_token=2YotnFZFEjr1zCsicMWpAA
&token_type=Bearer
&expires_in=3600
&state=123abc
/authorize?client_id=oauth_client
&response_type=id_token token
&scope=openid profile email api1
&redirect_uri=https://localhost:5000/callback
&state=123abc
&nonce=789xyz

24. {
"code": "asdhjbpeivdafgj",
"id_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6IjdlOW...",
"state": "123abc"
}
OpenID Connect - Hybrid Flow
/authorize?client_id=oauth_client
&response_type=code id_token
&scope=openid profile api1
&redirect_uri=https://localhost:5000/callback
&state=123abc
&nonce=789xyz

25. Response Types
Authorization Code code
Implicit id_token
Implicit id_token token
Hybrid code id_token
Hybrid code token
Hybrid code id_token token

26. OAuth Grant Types - Client Credentials
POST /token {
grant_type=client_credentials
&client_id=oauth_client
&client_secret=supersecret
}
{
"access_token": "2YotnFZFEjr1zCsicMWpAA",
"token_type": "Bearer",
"expires_in": 3600
}

27. OAuth Grant Types - Resource Owner Password Credentials
/token {
grant_type=password
&client_id=oauth_client
&client_secret=supersecret
&username=scott
&password=Password123!
}
{
"access_token": "2YotnFZFEjr1zCsicMWpAA",
"token_type": "Bearer",
"expires_in": 3600
}
DO NOT USE THIS

28. Refresh Tokens
● Request the offline_access
scope
● Can swap refresh tokens for new
access tokens
● Does not require user interaction
POST /token {
grant_type=refresh_token
&refresh_token=tGzv3JOkF0XG5Qx2Tl
&client_id=oauth_client
&client_secret=supersecret
}
{
"access_token": "2YotnFZFEjsWpAA",
"token_type": "Bearer",
"expires_in": 3600,
"refresh_token": "cHafsg2OkgoBtgh"
}

29. IdentityServer 4
● Implements OAuth 2.0 & OpenID Connect 1.0
○ An “OpenID Provider”
● Open Source & Part of the .NET Foundation
● Framework

30. IdentityServer 4

31. Next Steps
● ASP.NET Core Identity
● User Management Functionality
● identityserver.com
● scottbrady91.com