Security is unfortunately a low-priority, nonfunctional requirement and is often overlooked as a result. Reworking it in an existing system is a daunting task, especially when it means providing different levels of security for internal and external calls. The whole undertaking is challenging, but it should not be so. Attending this session will show you a fast and easy way of introducing OAuth 2.0 authentication and authorization into any environment with minimal impact on M2M integrations already in place.

1. Retrofi8ng
OAuth
2.0
Security
into
Exis?ng
REST
Service
[CON1765]
Irena
Shaigorodsky
Java
One,
2014
ishaigorodsky@enservio.com
@ishaigorodsky
hOps://github.com/ishaigor/rest-­‐retro-­‐sample
©
2014
Enservio.
All
1
rights
reserved.

2. ©
2014
Enservio.
All
2
rights
reserved.
Quick
Survey
• How
many
☐Use
or
plan
to
use
rich
REST
based
UI
for
sensi?ve
informa?on?
☐Know
what
OAuth
is?
Use
or
plan
to
use
rich
REST
based
UI
with
OAuth?
☐Use
spring/spring-­‐security/spring-­‐security-­‐oauth?

3. ©
2014
Enservio.
All
Agenda
3
rights
reserved.
• Security
Cost
• OAuth
2.0
• Sample
deep-­‐dive

4. ©
2014
Enservio.
All
Why
My
Company
Needs
Security?
4
rights
reserved.
• Cost
of
security
breach
in
US[1]
– $188
per
record
– average
size:
28,765
records
– customer
loss
• Customer
driven
[1]
2013
Cost
of
Data
Breach
Study:
Global
Analysis
by
Ponemon
Ins?tute©
sponsored
by
Symantec

5. OAuth
2.0
“An
open
protocol
to
allow
secure
authoriza?on
in
a
simple
and
standard
method
from
web,
mobile
and
desktop
applica?ons.”[1]
“The
OAuth
2.0
authoriza?on
framework
enables
a
third-­‐party
applica?on
to
obtain
limited
access
to
an
HTTP
service.”[1]
©
2014
Enservio.
All
5
rights
reserved.
[1]
hOp://oauth.net/

6. ©
2014
Enservio.
All
OAuth
2.0
Lingo
6
rights
reserved.
• Resource
– Resource
Owner
– Resource
Server
• OAuth
2.0
scope
• OAuth
2.0
client
• Endpoints
– Authoriza?on
Endpoint
– Token
Endpoint
• Tokens
– Access
Token
– Refresh
Token
• Authoriza?on
Grant
hOp://wiki.scn.sap.com/wiki/display/Security/OAuth+2.0+Terminology

7. ©
2014
Enservio.
All
OAuth
2.0
Flows
7
rights
reserved.
• Authoriza*on
Code
Grant
Flow
– Google
– Facebook
• Resource
Owner
Password
Creden?al
Flow
• Client
Creden?al
Flow
• Implicit
Grant
Flow
– JavaScript
client

8. ©
2014
Enservio.
All
8
rights
reserved.
Securing
REST
calls:
OAuth
2.0
• Authoriza?on
Code
Grant
Flow
hOp://docs.oracle.com/cd/E39820_01/doc.11121/gateway_docs/content/images/oauth/oauth_web_server_flow.png

9. ©
2014
Enservio.
All
OAuth
2.0
Flows
9
rights
reserved.
• Authoriza?on
Code
Grant
Flow
– Google
– Facebook
• Resource
Owner
Password
Creden*al
Flow
• Client
Creden?al
Flow
• Implicit
Grant
Flow
– JavaScript
client

10. ©
2014
Enservio.
All
Securing
REST
calls:
OAuth
2.0
10
rights
reserved.
• Resource
Owner
Password
Creden?al
Flow
hOp://docs.oracle.com/cd/E39820_01/doc.11121/gateway_docs/content/images/oauth/oauth_username_password_flow.png

11. ©
2014
Enservio.
All
OAuth
2.0
Flows
11
rights
reserved.
• Authoriza?on
Code
Grant
Flow
– Google
– Facebook
• Resource
Owner
Password
Creden?al
Flow
• Client
Creden*al
Flow
• Implicit
Grant
Flow
– JavaScript
client

12. ©
2014
Enservio.
All
Securing
REST
calls:
OAuth
2.0
12
rights
reserved.
• Client
Creden?al
Flow
hOp://docs.oracle.com/cd/E39820_01/doc.11121/gateway_docs/content/images/oauth/oauth_client_creden?als_flow.png

13. ©
2014
Enservio.
All
OAuth
2.0
Flows
13
rights
reserved.
• Authoriza?on
Code
Grant
Flow
– Google
– Facebook
• Resource
Owner
Password
Creden?al
Flow
• Client
Creden?al
Flow
• Implicit
Grant
Flow
– JavaScript
client

14. ©
2014
Enservio.
All
Securing
REST
calls:
OAuth
2.0
14
rights
reserved.
• Implicit
Grant
Flow
hOp://docs.oracle.com/cd/E39820_01/doc.11121/gateway_docs/content/images/oauth/oauth_user_agent_flow.png

15. ©
2014
Enservio.
All
Sample
deep-­‐dive
15
rights
reserved.
hOps://github.com/ishaigor/rest-­‐retro-­‐sample
• Unprotected
JavaScript
Widget
– Unprotected
REST
Words
Service
• Spring
MVC
– Legacy
protected
JSP
/
JavaScript
Widget
• Spring
Security
• AngularJS
• Protected
Widget
– Protected
service
• Spring
Security
OAuth
– Protected
client
• Spring
Security
Oauth
– HTTP
Authoriza?on
Header
• Protected
gateway
– Spring
Integra?on
– Customiza?on

16. ©
2014
Enservio.
All
Meet
the
unprotected
REST
Service
(Spring
MVC)
16
rights
reserved.
• @RestController

17. Meet
secure
legacy
client
with
unprotected
Rich
UI
(Spring
Security,
Spring
MVC,
AngularJS)
©
2014
Enservio.
All
17
rights
reserved.
• ng-­‐infinite-­‐scroll
• AbstractDispatcherServletIni?alizer
– springSecurityFilterChain
• WebSecurityConfigurerAdapter
– @EnableWebSecurity
– Authen?ca?onManagerBuilder
– WebSecurity
– HOpSecurity
• Persistence
– Data
source
– Group
authori?es
by
user
name

18. ©
2014
Enservio.
All
18
rights
reserved.
Spring
Security:
User
Details

19. Meet
secure
legacy
client
with
unprotected
Rich
UI
(Spring
Security,
Spring
MVC,
AngularJS)
–cont’d
©
2014
Enservio.
All
19
rights
reserved.
• <%@
taglib
prefix="authz"
uri="hOp://
www.springframework.org/security/tags"%>
• <authz:authorize
ifAllGranted="ROLE_USER">…</
authz:authorize>

20. ©
2014
Enservio.
All
Sample
deep-­‐dive
20
rights
reserved.
hOps://github.com/ishaigor/rest-­‐retro-­‐sample
• Unprotected
JavaScript
Widget
– Unprotected
REST
Words
Service
• Spring
MVC
– Legacy
protected
JSP
/
JavaScript
Widget
• Spring
Security
• AngularJS
• Protected
Widget
– Protected
service
• Spring
Security
OAuth
– Protected
client
• Spring
Security
Oauth
– HTTP
Authoriza?on
Header
• Protected
gateway
– Spring
Integra?on
– Customiza?on

21. Protected
Service
(Spring
Security,
Spring
MVC)
©
2014
Enservio.
All
21
rights
reserved.
• Authoriza?onServerConfigurerAdapter
– ClientDetailsServiceConfigurer
– @EnableAuthoriza?onServer
– Authoriza?onServerEndpointsConfigurer
– Authoriza?onServerSecurityConfigurer
• GlobalMethodSecurityConfigura?on
– @EnableGlobalMethodSecurity
– OAuth2MethodSecurityExpressionHandler

22. Protected
Service
(Spring
Security,
Spring
MVC)
–
cont’d
©
2014
Enservio.
All
22
rights
reserved.
• ResourceServerConfigurerAdapter
– ResourceServerSecurityConfigurer
– HOpSecurity
• .csrf().requireCsrfProtec?onMatcher(new
AntPathRequestMatcher("/
oauth/authorize")).disable()
• Persistence
– TokenStore
– ClientTokenServices
– Authoriza?onCodeServices
– ApprovalStore
• ApprovalStoreUserApprovalHandler

23. Protected
Service
(Spring
Security,
Spring
MVC)
–
cont’d
©
2014
Enservio.
All
23
rights
reserved.

24. Protected
Service
(Spring
Security,
Spring
MVC):
tes?ng
©
2014
Enservio.
All
24
rights
reserved.
• @BeforeOAuth2Context
• @OAuth2ContextConfigura?on
• BaseOAuth2ProtectedResourceDetails
• Integra?onTest
• Integra?onTestHelper

25. Protected
client,
protected
Rich
UI
(Spring
Security,
Spring
MVC,
Spring
Security
OAuth
2.0)
©
2014
Enservio.
All
25
rights
reserved.
• Authen?ca?onManager
– eraseCreden?als
• Applica?onListener<AbstractAuthen?ca?onEvent>
– ResourceOwnerPasswordAccessTokenProvider
• CustomAuthen?ca?onDetailsSource
– CustomAuthen?ca?onDetails
– WebAuthen?ca?onDetailsSource

26. ©
2014
Enservio.
All
Protected
service
with
Spring
26
rights
reserved.
• Limita?ons:
– Added
security
overhead
– No
unprotected
internal
access

27. ©
2014
Enservio.
All
Sample
deep-­‐dive
27
rights
reserved.
hOps://github.com/ishaigor/rest-­‐retro-­‐sample
• Unprotected
JavaScript
Widget
– Unprotected
REST
Words
Service
• Spring
MVC
– Legacy
protected
JSP
/
JavaScript
Widget
• Spring
Security
• AngularJS
• Protected
Widget
– Protected
service
• Spring
Security
OAuth
– Protected
client
• Spring
Security
Oauth
– HTTP
Authoriza?on
Header
• Protected
gateway
– Spring
Integra?on
– Customiza?on

28. Security
Gateway
Pass
Through
with
Spring
Integra?on
©
2014
Enservio.
All
28
rights
reserved.
• int-­‐hOp:inbound-­‐gateway
• int-­‐hOp:outbound-­‐gateway
• int:channel
• int:annota?on-­‐config
• int-­‐jmx:mbean-­‐export

29. Security
Gateway
Pass
Through
with
Spring
Integra?on:
customiza?on
©
2014
Enservio.
All
29
rights
reserved.
• OutboundHeaderMapper
• RangeEnforcer
• CustomOAuth2WebSecurityExpressionHandler
• CustomSecurityExpressionMethods
• ClientHOpRequestFactory

30. ©
2014
Enservio.
All
Resources
30
rights
reserved.
• hOp://oauth.net/2/
• hOp://projects.spring.io/spring-­‐security/
• hOp://projects.spring.io/spring-­‐security-­‐oauth/
• hOps://github.com/ishaigor/rest-­‐retro-­‐sample
• hOp://binarymuse.github.io/ngInfiniteScroll/

31. ©
2014
Enservio.
All
31
rights
reserved.
OAuth 2.0 Bearer for
JavaScript /external REST IdP with SSO
WS-Security /SAML for
SOAP
Digest / Signatures
Encryption
OAuth 2.0 SAML
OAuth 2.0 MAC
Security
Roadmap
Address
REST
Services
Exposure
Merge
user
iden??es
in
a
single
directory
Centralize
iden?ty
management
Build
secure
APIs
with
our
customers
Other
enhancements

32. ©
2014
Enservio.
All
32
rights
reserved.