Identity and access management are a core part of any solution design. Your web, mobile and rich client applications require a user login experience that typically involves a single sign-on (SSO) experience, APIs are called from client-facing applications, from background workers, and through multiple application tiers. And then, of course, there is the need for fine-grained authorization to control access to application areas, APIs, and other resources. This session will give you a top to bottom tour for implementing a secure solution based on standards like OAuth2 and OpenID Connect, in addition to showing you a permissions model after which you can pattern authorization checks throughout the code. In the process we’ll also look at recommended practices for each step from user login, session management, secure token flow across tiers. Code demonstrations will be based on ASP.NET but relevant to other platforms in practice.

2. IDaaS - Modern Security for your
Web Apps and APIs
Michele Leroux Bustamante
Cofounder, Solliance
Cloud / Security Architect
michelebusta@solliance.net

3. Example Solution Topology
Backend
Web API
Browser
Java
Script
Web App
JS
Web API
Server
Process
Mobile
App
Mobile
Web API
API Gateway
Partner
Web API
Queues
Third Party
Apps

5. Example Solution Topology
Backend
Web API
Browser
Java
Script
Web App
JS
Web API
Server
Process
Mobile
App
Mobile
Web API
LOGIN
API Gateway
Partner
Web API
LOGIN
Queues
Authorization
Server
Third Party
Apps
LOGIN

6. Concepts
• Authentication
• User, application / service
• Token Flow
• Authentication, front end APIs, back end APIs
• Token validation, delegation, lifetime management
• Protocols
• OpenID Connect, OAuth2, JSON Web Token (JWT)
• Types of Tokens
• ID token
• Access token
• Refresh token
• Reference token

7. OAuth2 Concepts
• Separate role of client and resource owner
• Resource owner (end-user)
• Resource server (protects resource, requires token)
• Client (makes requests for resource owner)
• Authorization Server (issues token after authenticating resource
owner and getting authorization for the client)

8. Authorization Grants
• Implicit
• Code
• Resource Owner
• Client Credentials
• Custom

9. Authorization Server Trust
• Client is registered with AS first
• Client usually has
• Id
• Secret
• Allowed callback URLs
• Allowed scopes

10. Web User Login
• Redirect to Login page at AS
• From web application server
• From Browser
• From iframe

11. OIDC / Implicit Passive Redirect
Browser
1 27
OIDC
Request
4
3
POST
Credentials
Set
Cookie
6
Web Site AS
Authenticate
Issue Token
5
Login
Page

12. DEMO

13. Browser
OIDC
request
3
2
POST
credentials
5
Web App AS
Login
Page
token
(hash
fragment)
Java
Script
Web API
4
1
Implicit Flow / Access Token (SPA)

14. JavaScript to APIs
• Token available to Browser
• Retrieved during login
• Returned with page security context
• Watch the PII
• Calls back to APIs
• Within web application
• CORS

15. 2
OIDC
Request
4
3
POST
credentials
AS
Login
Page
Browser
16
set
Cookie
Render
token
5
Web App Web API
JavaScript calls to Web API (1)

16. JavaScript calls to Web API (2)
Browser
Web API
HTML
/JS
token is passed in the
Authorization header
1
Validate Token /
Authorize Access
2
token is embedded in the
page

17. DEMO

18. Browser
IODC
request
3
2
POST
credentials
Web App AS
Login
Page
Java
Script
Web API
1
Implicit Flow / Access Token (SPA)
5
4

19. Web Application / API to Web API
• Have a token (user login)
• Passed to Web API
• Written to cookie (for pages)
• Request new token (delegation)
• Options
• ID token for ID token
• ID token for access token
• Access token for access token
• …
• Act As
• Not an official specification (in progress)

20. 2
Delegation
Request
3
AS
1
Backend
Web API
4
Browser
Java
Script
Web App Web API
Calling APIs / Act-As

21. DEMO

22. Background Workers
• No user login, unattended
• Alternative to token exchange
• Trusted subsystem model
• Client credentials (client id and secret)

23. 2
OAuth2
Client Credentials
3
AS
1
Server Process / App
Web API
Client Credentials Flow
/ Trusted Subsystem

24. DEMO

25. Mobile Apps
• Native login (same for rich clients)
• Resource Owner flow
• User provides credentials
• Web View
• Implicit flow
• Creates SSO session with AS
• Hybrid models

26. Mobile Use Case (Web View)
Mobile
App
1 OAuth2
Implicit Flow
3
2
POST
Credentials
AS
Authenticate
Issue Claims
4
Login
Page
Java
Script
5
Mobile
Web API
6
7

27. Mobile Use Case (Native)
Mobile
App
2 Resource
Owner
Flow
1
4
POST
Credentials
AS
Authenticate
Issue Token
3
Login
Page
5
Mobile
Web API

28. Tokens Types
• ID tokens
• Access Tokens
• Reference Tokens
• Refresh Tokens

29. Login / Web Session
78
Id Token
(15 mins)
Web Site AS
Login
Page
Access
Token
(1 day)
App Cookie User navigates
to protected
page
{…}
Access Token
(1 day)
1
OIDC
request
2
6
3 4
User
Credentials
(15 mins)
SSO Cookie
(1 day)
6

30. JS to API
Browser / SPA
1
JS
JS API
AT1
AS
(AT1)
Session Cookie

31. API to API / pre-cache
Browser/SPA
1
2
34
JS
JS API AS
(AT1)
Session
API Token Cache
(15 mins)
(AT1)
(AT2)
(AT2)
(15 mins)
Client id + secret
Back End API
5 (AT2)

32. API to API / post-cache
Browser/SPA
1
2
JS
JS API AS
(AT1)
Session
API Token Cache
(15 mins)
(AT2)
Back End API
3 (AT2)

33. Trusted Sub
1
23
Client App AS
API Token Cache
(15 mins)
(AT3)
(AT3)
(15 mins)
Client id
+ secret
Back End API
4 (AT3)

34. Permissions Management
• Permission Tables
• Resource Authorization
• Keeping logic in a single place
• Entire app prevention
• Controller Attributes
• Inline demands

35. Claims and Permissions
AS
Claims
App
AS
Claims
IdP
Identity
Claims
Permissions
Additional
Claims
User Identity
- Roles - User ID
- Email
- Username
…
Linked
Claims
IdP
Claims
- UPN
- Email
- Username
…
Roles
Permissions
Claims
AS

36. Permissions Model
Role
Permission
Resource
Action

37. DEMO

39. Example Solution Topology
Backend
Web API
Browser
Java
Script
Web App
JS
Web API
Server
Process
Mobile
App
Mobile
Web API
LOGIN
API Gateway
Partner
Web API
LOGIN
Queues
Authorization
Server
Third Party
Apps
LOGIN

40. How to reach me…
Michele Leroux Bustamante
michelebusta@solliance.net
@michelebusta
Solliance Cofounder
Cloud / Security Architect
Microsoft Regional Director since 2003
Microsoft MVP – Microsoft Azure
Azure Elite, Azure Insider

41. Glöm inte att utvärdera sessionen direkt i
Microsoft TechDays-appen!