You are previewing OAuth 2.0 Identity and Access Management Patterns.
O'Reilly logo
OAuth 2.0 Identity and Access Management Patterns

Book Description

Want to learn the world’s most widely used authorization framework? This tutorial will have you implementing secure Oauth 2.0 grant flows without delay. Written for practical application and clear instruction, it’s the complete guide.

  • Build web, client-side, desktop, and server-side secure OAuth 2.0 client applications by utilizing the appropriate grant flow for the given scenario

  • Get to know the inner workings of OAuth 2.0 and learn how to handle and implement various authorization flows

  • Explore practical code examples that are executable as standalone applications running on top of Spring MVC

  • In Detail

    OAuth 2.0 has become the most widely used authorization framework. It provides an easy-to-use sign-in mechanism and allows users to quickly and efficiently secure service APIs. It also provides a protection layer for assets so that various third-party applications cannot have direct access to them. From service providers like Amazon and social media platforms like Facebook and Twitter to various internal enterprise solutions, OAuth 2.0 is the preferred standard for authorization.

    OAuth 2.0 Identity and Access Management Patterns is a step-by-step guide to build web, client-side, desktop, and server-side secure OAuth 2.0 client applications by utilizing the appropriate authorization techniques.. This book will help you handle and implement various authorization flows for your chosen type of application. Furthermore, you will understand when and how OAuth 2.0 is used in enterprises for trusted and first-party applications. You will gain knowledge about the Resource Owner Password Credentials grant and the Client Credentials grant, and more importantly, you will understand how to implement them yourself with the help of practical code examples.

    You will start by making various client applications step-by-step before moving on to client registration and implementing various OAuth 2.0 authorization flows. Furthermore, you will also be handling server responses with access tokens and errors. By the end of this book, you should understand precisely what it takes for these client applications to be secured.

    This book helps you cover each type of application: web, client-side, desktop, and trusted applications. In addition, you are also shown how to implement various authorization grant flows for each of these applications. You will uncover the security features that are a part of OAuth 2.0. More importantly, the book demonstrates what information is transmitted during the execution of a flow, and which precautions can be made. With OAuth 2.0 Identity and Access Management Patterns, you will be able to build a secure OAuth 2.0 client application with full confidence and will completely understand what data is exchanged when performing an authorization grant flow.

    Data Visualization with d3.js will unveil the mystery behind all those beautiful examples you've been admiring.

    Table of Contents

    1. OAuth 2.0 Identity and Access Management Patterns
      1. Table of Contents
      2. OAuth 2.0 Identity and Access Management Patterns
      3. Credits
      4. About the Author
      5. About the Reviewers
      6. www.PacktPub.com
        1. Support files, eBooks, discount offers and more
          1. Why Subscribe?
          2. Free Access for Packt account holders
      7. Preface
        1. What this book covers
        2. What you need for this book
        3. Who this book is for
        4. Conventions
        5. Reader feedback
        6. Customer support
          1. Downloading the example code
          2. Errata
          3. Piracy
          4. Questions
      8. 1. Need for OAuth 2.0
        1. Why OAuth 2.0?
        2. Benefits of OAuth 2.0
          1. API security
          2. Internal enterprise applications
          3. Service integration and authorization delegation
          4. Federated identity
          5. Easier service monitoring
        3. Summary
      9. 2. Terms You Need To Know
        1. Roles
          1. Resource owner
          2. Authorization server
          3. Resource server
          4. Client
        2. Authorization flow
          1. Abstract example
          2. OAuth 2.0 grant flows
        3. Tokens
          1. Access token
          2. Refresh token
        4. Clients and endpoints
          1. Client types and profiles
          2. Endpoints
        5. Access scope
        6. Summary
      10. 3. First Step for Your Application
        1. Client registration
        2. Summary
      11. 4. OAuth for Web Server Applications
        1. Authorization code grant
          1. Requesting the authorization code
            1. Making the request
            2. Successful authorization
            3. Authorization error
          2. Requesting the access token
            1. Making the request
            2. Successful response
        2. Practical example
        3. Summary
      12. 5. OAuth for Client-side Applications
        1. Implicit grant
        2. Requesting authorization
          1. Successful authorization
          2. Authorization error
        3. Practical example
        4. Summary
      13. 6. OAuth for Mobile Applications
        1. Custom URL scheme
          1. Android
          2. iOS
        2. Implicit grant example
          1. Requesting authorization
          2. Successful authorization
          3. Authorization error
        3. Summary
      14. 7. OAuth for Trusted Applications
        1. Resource owner password credentials grant
          1. Requesting authorization
          2. Successful authorization
          3. Authorization error
        2. Client credentials grant
          1. Requesting authorization
          2. Successful authorization
          3. Authorization error
        3. Practical example
          1. Resource owner password credentials grant
          2. Client credentials grant
        4. Summary
      15. 8. Security Considerations
        1. What is there to be protected
        2. OAuth 2.0 security features
          1. Scope
          2. Token lifetime
          3. The refresh token
          4. Authorization code
          5. Redirect URI
          6. State
          7. Client identifier
        3. Security considerations
          1. Use TLS
          2. Ensure web server application protection
          3. Ensure mobile and desktop application protection
          4. Utilize the state parameter
          5. Use refresh tokens when available
          6. Request the needed scope only
        4. Summary
      16. 9. Additional Security with SAML
        1. SAML (2.0)
        2. OAuth 2.0 assertions
          1. Other assertion based specifications
        3. OAuth 2.0 SAML bearer assertion grant flow
          1. Preparing assertion
          2. Requesting authorization
          3. Successful authorization
          4. Authorization error
        4. OAuth 2.0 SAML assertions for client authentication
          1. Requesting the access token
          2. Authentication error
        5. Summary
      17. 10. Common Tools and Libraries
        1. Tools
          1. OAuth 2.0 Playground
          2. RESTClient
          3. Postman
        2. Libraries
          1. C#
          2. Clojure
          3. Go
          4. Java
          5. JavaScript
          6. Objective-C
          7. Perl
          8. PHP
          9. Python
          10. Ruby
          11. Scala
        3. Summary
      18. A. OAuth 2.0 Resources
        1. OAuth 2.0 specification
        2. OAuth WG mailing list
        3. OAuth 2.0 Threat Model and Security Considerations
        4. The OAuth 2.0 Authorization Framework - Bearer Token Usage
        5. Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants
        6. SAML 2.0 Profile for OAuth 2.0 Client Authentication and Authorization Grants
        7. OAuth website
      19. Index