Identity Management: Using OIDC to Empower the Next-Generation Apps
•Descargar como PPTX, PDF•
1 recomendación•368 vistas
The document discusses using OpenID Connect (OIDC) to enable authentication for mobile and cloud applications. It outlines some challenges of moving to mobile and cloud platforms, such as how to reuse existing systems and maximize past investments. The document then presents OIDC as a solution, describing how it allows for flexible authentication of users across devices and applications through an open standard for identity federation. It provides examples of how OIDC improves upon traditional authentication methods for both service accounts and user-based access.
Recomendados
Recomendados
Más contenido relacionado
La actualidad más candente
La actualidad más candente (20)
Destacado
Destacado (15)
Similar a Identity Management: Using OIDC to Empower the Next-Generation Apps
Similar a Identity Management: Using OIDC to Empower the Next-Generation Apps (20)
Más de Tom Freestone
Último
Último (20)
Identity Management: Using OIDC to Empower the Next-Generation Apps
- 1. Identity Management: Using OIDC to Empower the Next-Generation of Applications Tom Freestone LDS Church © 2016 by Intellectual Reserve, Inc. All rights reserved.
- 2. The future computing platforms are MOBILE and CLOUD! Mobile Computing - present and the future 2.4 billion mobile devices in 2013 and 2.5 billion in 2014. 81+ billion apps downloaded in 2013. There are 6.8 billion people on the planet at present. 4 billion own mobile phones. Gartner Group - World Wide Devices Shipments Internet of Things In the Cloud EVERYTHING is an API. APIs are an integral part of what are arguably the three major forces currently transforming the Web and IT landscape —Mobile, Social and Cloud Computing. API © 2016 by Intellectual Reserve, Inc. All rights reserved.
- 3. • How do we design and develop solutions that meet the growth and the diversity of a global user base? • How do we move large enterprise solutions and systems to embrace mobile and cloud computing? • How do we maximize our past investments in technology solutions and embrace new and evolving industry technology advancements? • How do we significantly reduce costs and encourage greater reuse of core systems and services across the enterprise? Preparing for the future - MOBILE and CLOUD! © 2016 by Intellectual Reserve, Inc. All rights reserved.
- 4. Legacy Applications & Systems Monolithic Application-centric DB-coupled Component & Services Architecture Web Services Integrations Mobile/Web Components Mobile – Web - Device Platform as a Service Hybrid CloudData Center AWS Azure Cloud Mobile Application Architecture © 2016 by Intellectual Reserve, Inc. All rights reserved.
- 5. IdentityIdentity ? © 2016 by Intellectual Reserve, Inc. All rights reserved.
- 6. Identity ? AuthorizationAuthentication © 2016 by Intellectual Reserve, Inc. All rights reserved.
- 7. ? Who is the user? Entity Claims Attributes Identity is a set of claims. © 2016 by Intellectual Reserve, Inc. All rights reserved.
- 8. Entity Attributes https://www.flickr.com/photos/74373690@N00/13949707621/ via Compfight (License: https://creativecommons.org/licenses/by-nc/2.0/)
- 9. What is the user allowed to do? Who What Why WhenHow Attributes Policy © 2016 by Intellectual Reserve, Inc. All rights reserved.
- 10. What is the user allowed to do? Authenticated Users Users that work for … Users that belong to Web Access Mgmt. © 2016 by Intellectual Reserve, Inc. All rights reserved.
- 11. Reverse Proxies • Passes Headers • Protects URL’s • Manages SSO Session • Data Center Co-location The Traditional Solution: Authorization/Authentication? © 2016 by Intellectual Reserve, Inc. All rights reserved.
- 12. The world of reverse proxies … protected, but ... https://www.flickr.com/photos/13748147@N02/2070083736/ via Compfight (License: https://creativecommons.org/licenses/by-nc-nd/2.0/)
- 13. The real world is complex and interconnected. http://steffondavis.com/visualizing-taste-in-art-with-big-data-curation-analysis-curalytics-and-curiator/
- 14. Enterprise SaaS Private Cloud PaaS (Cloud foundry) Development Stacks Web Services PaaS Web Services Public CloudPublic Cloud Hybrid Cloud Cloud Approach Hybrid Cloud: A cloud computing service that is composed of some combination of private, public, and community cloud services, from different service providers, for capacity or capability Cloud Mobile Integration • Must support existing systems (legacy) = Hybrid • Everything moving to “Services” (APIs) • Mobile/Web Development (Open Standards) • Services Oriented Architecture (SOA) • Migration/On Ramp (Security, SaaS, etc.) © 2016 by Intellectual Reserve, Inc. All rights reserved.
- 15. How do we move to the cloud and still authenticate our users? © 2016 by Intellectual Reserve, Inc. All rights reserved.
- 16. Federation © 2016 by Intellectual Reserve, Inc. All rights reserved.
- 17. Traditional vs. Federated Reverse Proxies • Passes Headers • Protects URL’s • Manages SSO Session • Data Center Colocation Application • Consumes attributes • Protects its own URL’s • Manages its own session • Data Center Independence © 2016 by Intellectual Reserve, Inc. All rights reserved.
- 18. Icon design by Paomedia and Ivan Boyko Interoperable Flexible Secure Simple OIDC Benefits © 2016 by Intellectual Reserve, Inc. All rights reserved.
- 19. Basic OIDC Protocol End User OIDC Provider Client 1. AuthN Request 2. AuthN & AuthZ 3. AuthN Response 4. UserInfo Request 5. UserInfo Response Abstract OIDC Protocol: 1.2 OIDC-Core Spec Client application requiring End-User Authentication and Claims from an OIDC Provider. Provides identity as a service using OIDC through the Token endpoint, UserInfo endpoint, & Authorization endpoint. Also referred to as the “User Agent,” meaning the browser. © 2016 by Intellectual Reserve, Inc. All rights reserved.
- 20. AntiPattern #1 LDAP Service Accounts Application / Client Get Use Protected API (Resource Server) LDAP 1. Request (Basic Auth username: password) 2. LDAP Bind username:password 3. Data © 2016 by Intellectual Reserve, Inc. All rights reserved.
- 21. Pattern #1 Service Account using OIDC Application / Client Get Use 1. Request Token (Client_id / userId) Token Token 2. 3. Make Request Protected API Authorization Server 4. Validate Token 5. Valid Token 7. Return Data Token © 2016 by Intellectual Reserve, Inc. All rights reserved.
- 22. Pattern #1 Service Account – Getting Tokens curl https://openam.example.com:8443/openam/.well-known/openid-configuration { "response_types_supported": [ "token id_token", "code token", "code token id_token", "token", "code id_token", "code", "id_token" ], "registration_endpoint": "https://ident.example.com:8443/openam/oauth2/connect/register", "token_endpoint": "https://ident.example.com:8443/openam/oauth2/access_token", "end_session_endpoint": "https://ident.example.com:8443/openam/oauth2/connect/endSession", "version": "3.0", "userinfo_endpoint": "https://ident.example.com:8443/openam/oauth2/userinfo", "subject_types_supported": [ "public" ], "issuer": "https://ident.example.com:8443/openam", "jwks_uri": "https://ident.example.com:8443/openam/oauth2/connect/jwk_uri?realm=/", "id_token_signing_alg_values_supported": [ "HS256", "HS512", "RS256", "HS384" ], "check_session_iframe": "https://ident.example.com:8443/openam/oauth2/connect/checkSession", "claims_supported": [ "phone", "email", "address", "openid", "profile" ], "authorization_endpoint": "https://ident.example.com:8443/openam/oauth2/authorize" } curl --request POST --user "masterClient:password" --data "grant_type=password&username=someUser&password=password" https://ident.example.com:8443/openam/oauth2/access_token { "expires_in": 59, "token_type": "Bearer", "refresh_token": "26938cd0-6870-4e31-ade9-df31afc37ee1", "access_token": "515d6551-4512-4279-98b6-c0ef3f03a722" } Authorization, Bearer 515d6551-4512-4279-98b6-c0ef3f03a722 © 2016 by Intellectual Reserve, Inc. All rights reserved.
- 23. 1. Using App Client Login Page Owner 3. Post User/password to login page 4. Get cookies 5. Request Data 6. Data 2. Collect User/Password Get Use AntiPattern #2 Session Hijack © 2016 by Intellectual Reserve, Inc. All rights reserved
- 24. 1. Using App Client Authorization Server Owner 3.Authorize 4. Authorization Code 5. Authorization Code Token 6. Resource Server Token Token7. Request Data 8. Validate Token 9. Valid Token10. Data 2. Redirect to Login Get Use Pattern #2 Service Provider Access Using OIDC [1]R. Boyd, Getting started with Oauth 2.0. Sebastopol, CA: O’Reilly, 2012.c © 2016 by Intellectual Reserve, Inc. All rights reserved.
- 25. Pattern #2 Service Provider Access -- Responses [2] Backstage.forgerock.com, ‘ForgeRock BackStage’, 2015. [Online]. Available: https://backstage.forgerock.com/#!/docs/ openam/12.0.0/admin-guide/chap- opened-connect. [Accessed: 08- Oct- 2015]. © 2016 by Intellectual Reserve, Inc. All rights reserved.
- 26. Legacy Applications & Systems Monolithic Application-centric DB-coupled Component & Services Architecture Web Services Integrations Mobile/Web Components Mobile – Web - Device Platform as a Service Hybrid CloudProvo/Church Data Center AWS Azure © 2016 by Intellectual Reserve, Inc. All rights reserved. Cloud Mobile Application Architecture
- 27. The future computing platforms are MOBILE and CLOUD! Mobile Computing - present and the future 2.4 billion mobile devices in 2013 and 2.5 billion in 2014. 81+ billion apps downloaded in 2013. There are 6.8 billion people on the planet at present. 4 billion own mobile phones. Gartner Group - World Wide Devices Shipments Internet of Things In the Cloud EVERYTHING is an API. APIs are an integral part of what are arguably the three major forces currently transforming the Web and IT landscape —Mobile, Social and Cloud Computing. API © 2016 by Intellectual Reserve, Inc. All rights reserved.
- 28. Questions? © 2016 by Intellectual Reserve, Inc. All rights reserved.
Notas del editor
- Develop an API First - Before you build your website, web, mobile or single page application you develop an API first, then you get to work on defining the channels you will be making the API resources available on. APIs are core to every cloud, social and mobile computing strategy. Everything and everyone will be API enabled. APIs are an economic imperative. Organizations must provide their core competence through APIs. Organizations must consume core competences of others through APIs. Comment on Internet of Things Over 50% of Internet connections are things. In 2011, there were over 15 billion things on the Web, with 50 billion+ intermittent connections. By 2020, there will be over 30 billion connected things, with over 200 billion with intermittent connections. Gartner Group – 2014 Trends How cool would it be to display your daily spiritual thought on your Microwave each morning?
- “Why We need to be preparing for the Future in Cloud and Mobile. How do we design and develop solutions that meet the growth and diversity of a globally expanding Church? How does the Church move their large enterprise solutions and systems to embrace mobile and cloud computing? How do we maximize our past investments in technology solutions and embrace new and evolving industry technology advancements? How do we significantly reduce costs and encourage greater reuse of core systems and services across the Church?
- To meet the current and future needs of a globally diverse church we must embrace Mobile and Cloud Computing as the means to reach our world-wide audience. Mobile computing is the future – and in many ways is the only means we have to reach the world-wide population. Cloud computing distributes computing and storage services around the world in a way that wasn’t possible just a few years ago. To effectively leverage both mobile and cloud computing, Web Services (APIs) are required. APIs allow us to integrate with legacy systems, databases, and back-end enterprise systems. The Cloud Mobile Integration (CMI) Platform delivers the technologies, systems, principles, processes, patterns, and services that enable ICS and the Church to fully embrace the “Services and Component Architecture” to support Mobile and Cloud computing.
- Identity answers the questions: who is the user? What is that user allowed to do?
- Who the user is = authentication What the user is allowed to do = authorization
- Because of the large investment in enterprise (on-premise) systems, the need to maximize these investments requires we build web services to front-end these systems. As we build web services to expose key information and functionality, we are able to build new web services that use these existing systems while at the same time, can access public cloud systems to deliver the next generation cloud and mobile solutions. Because of our legacy infrastructure, the CMI platform is designed to run on-premise (within our own data centers) or off-premise (in public cloud data centers). This approach provides a consistent environment of security, governance, API management, and use. The CMI platform is designed to support the Hybrid Cloud model so that solutions that run on the CMI platform can leverage both on-premise computing and off-premise computing transparently.
- Maintain WAM approach, but standardizing it. OpenID allows us to authenticate/authorize applications in a standard way (as opposed to WAM—proprietary way)
- Oauth 2.0 provides the base protocol. OpenID Connect is the identity layer. And OpenAM provides our OIDC implementation.
- Maintain WAM approach, but standardizing it. OpenID allows us to authenticate/authorize applications in a standard way (as opposed to WAM—proprietary way) OpenID Connect is a federation standard Federated makes calls: agree upon a common language to share information WAM: force our variables on you. Your application has to use WAM’s infrastructure No longer protected by wall – have to protect yourself
- Interoperable Standard was to requesting to claims. Claim: Attribute or a piece of information about an entity’s identity Scope: Short hands for predefined sets of claims User Endpoint to Get Attributes about the user and to translate various tokens Flexible How do we deal with Web vs Mobile vs Web services vs …? Identity as Services (IDaaS) Profiles / flows Secure Crypto awesome Levels of Security Simple / mobile friendly Don’t need harder protocols to implement Use JSON / REST
- Request authentication Login page / consent page Access token Get attributes
- To meet the current and future needs of a globally diverse church we must embrace Mobile and Cloud Computing as the means to reach our world-wide audience. Mobile computing is the future – and in many ways is the only means we have to reach the world-wide population. Cloud computing distributes computing and storage services around the world in a way that wasn’t possible just a few years ago. To effectively leverage both mobile and cloud computing, Web Services (APIs) are required. APIs allow us to integrate with legacy systems, databases, and back-end enterprise systems. The Cloud Mobile Integration (CMI) Platform delivers the technologies, systems, principles, processes, patterns, and services that enable ICS and the Church to fully embrace the “Services and Component Architecture” to support Mobile and Cloud computing.
- Develop an API First - Before you build your website, web, mobile or single page application you develop an API first, then you get to work on defining the channels you will be making the API resources available on. APIs are core to every cloud, social and mobile computing strategy. Everything and everyone will be API enabled. APIs are an economic imperative. Organizations must provide their core competence through APIs. Organizations must consume core competences of others through APIs. Comment on Internet of Things Over 50% of Internet connections are things. In 2011, there were over 15 billion things on the Web, with 50 billion+ intermittent connections. By 2020, there will be over 30 billion connected things, with over 200 billion with intermittent connections. Gartner Group – 2014 Trends How cool would it be to display your daily spiritual thought on your Microwave each morning?