This document provides an overview of OAuth and OpenID Connect specifications and grant types. It begins with introductions and defining key terms like tokens, scopes, and claims. It then explains the four main grant types - Authorization Code Flow, Implicit Flow, Resource Owner Password Flow, and Client Credentials Flow. The document notes extensions and recommends the Authorization Code Flow with PKCE for most use cases. It discusses related specifications around JSON Web Tokens, introspection, and revocation. It closes by emphasizing the need to understand which combination of specifications are required for a given implementation.

1. The Many
Layers Of OAuth
Danger Casey
API Problem Solver, GTM Guy, General Nuisance
danger@ngrok.com
May 2023

2. © ngrok. All rights reserved. Confidential Information of ngrok
01 Intro
02 OAuth Vocabulary
03 The Grant Types
04 Which one when?
05 The fun pain truth lies multitude of specs
06 Closing / Q&A
Agenda

3. 01
Who am I?

4. © ngrok. All rights reserved. Confidential Information of ngrok
Who am I?

5. © ngrok. All rights reserved. Confidential Information of ngrok
Who am I?
https://www.youtube.com/@geekamongthetrees

6. 02
OAuth Vocab

7. © ngrok. All rights reserved. Confidential Information of ngrok
© ngrok. All rights reserved. Confidential Information of ngrok
What is OAuth 2.0?
It’s unrelated to OAuth 1.0

8. © ngrok. All rights reserved. Confidential Information of ngrok
© ngrok. All rights reserved. Confidential Information of ngrok
What is OpenID Connect (OIDC)?
It’s unrelated to OpenID

9. © ngrok. All rights reserved. Confidential Information of ngrok
© ngrok. All rights reserved. Confidential Information of ngrok
Which is better: OAuth or OpenID Connect?
Trick question: OIDC is part of OAuth

10. © ngrok. All rights reserved. Confidential Information of ngrok
© ngrok. All rights reserved. Confidential Information of ngrok
Authentication
- vs -
Authorization

12. © ngrok. All rights reserved. Confidential Information of ngrok
- Resource Owner is you
- Grant Type (aka Flow) describes the use case
- Tokens represents the authorization, user or state
- Authorization Server (aka Auth Server) creates the tokens
- Scopes are the permissions you request from the Auth Server
- Claims are the fields & data returned from the Auth Server
- Resource Server is where you use the auth and id tokens
Key OAuth Terms

13. © ngrok. All rights reserved. Confidential Information of ngrok
- Resource Owner is you
- Grant Type how you get the tokens
- Tokens are the tokens
- Authorization Server creates the tokens
- Scopes how you request stuff in the token
- Claims the stuff in the token
- Resource Server where you use the token
Key OAuth Terms (simplified)

14. © ngrok. All rights reserved. Confidential Information of ngrok
Hotel Key Cards but for Apps

15. 03
Grant Types

16. © ngrok. All rights reserved. Confidential Information of ngrok
- Authorization Code Flow
- Implicit Flow
- Resource Owner Password Flow
- Client Credentials Flow
Grant Types (aka OAuth flows)

17. © ngrok. All rights reserved. Confidential Information of ngrok
Authorization Code Flow
User Auth
Client Auth

18. © ngrok. All rights reserved. Confidential Information of ngrok
Implicit Flow
User Auth
No Client Auth!

19. © ngrok. All rights reserved. Confidential Information of ngrok
Resource Owner Password Flow
User Auth
No Client Auth!
Wait. What does that mean!?
The app has your creds!

20. © ngrok. All rights reserved. Confidential Information of ngrok
Client Credential Flow
Client Auth
No User Auth!?

21. 04
Which should I use?

22. © ngrok. All rights reserved. Confidential Information of ngrok
Which do I use?
Wait. Where did
that come from?

23. © ngrok. All rights reserved. Confidential Information of ngrok
- Authorization Code Flow
- Implicit Flow
- Resource Owner Password Flow
- Client Credentials Flow
Grant Types (aka OAuth flows)

24. © ngrok. All rights reserved. Confidential Information of ngrok
- Authorization Code Flow
- Implicit Flow
- Resource Owner Password Flow
- Client Credentials Flow
Extensions
- Authorization Code Flow with PKCE
- SAML 2.0 Assertion Flow
- Device Grant Type
- Okta: Interaction Grant Type
Grant Types (aka OAuth flows)

25. © ngrok. All rights reserved. Confidential Information of ngrok
Authorization Code Flow with PKCE (RFC 7636)
User Auth
Client Auth

26. © ngrok. All rights reserved. Confidential Information of ngrok
SAML 2.0 Assertion Flow
Client Auth
No User Auth!?

27. © ngrok. All rights reserved. Confidential Information of ngrok
Which do I use?

28. © ngrok. All rights reserved. Confidential Information of ngrok
- Authorization Code Flow
- Implicit Flow - deprecated in favor of Auth Code+PKCE
- Resource Owner Password Flow - not recommended
- Client Credentials Flow
Extensions
- Authorization Code Flow with PKCE
- SAML 2.0 Assertion Flow
- Device Flow
- Okta: Interaction Grant Type
Grant Types (aka OAuth flows)

29. Specifications
05

30. © ngrok. All rights reserved. Confidential Information of ngrok
OAuth (RFC 6749)

31. © ngrok. All rights reserved. Confidential Information of ngrok
© ngrok. All rights reserved. Confidential Information of ngrok
Notice:
NOT authentication

32. © ngrok. All rights reserved. Confidential Information of ngrok
What about those tokens?

33. © ngrok. All rights reserved. Confidential Information of ngrok
© ngrok. All rights reserved. Confidential Information of ngrok
JWTs to the Rescue!
(JSON Web Tokens)

34. © ngrok. All rights reserved. Confidential Information of ngrok
© ngrok. All rights reserved. Confidential Information of ngrok
Ha.
You wish.

35. © ngrok. All rights reserved. Confidential Information of ngrok
JSON Web Token (RFC 7519)

36. © ngrok. All rights reserved. Confidential Information of ngrok
JSON Web Token (RFC 7519)

37. © ngrok. All rights reserved. Confidential Information of ngrok
JSON Web Token (RFC 7519)

38. © ngrok. All rights reserved. Confidential Information of ngrok
JSON Web Token (RFC 7519)

39. © ngrok. All rights reserved. Confidential Information of ngrok
© ngrok. All rights reserved. Confidential Information of ngrok
So then what do we do?

40. © ngrok. All rights reserved. Confidential Information of ngrok
© ngrok. All rights reserved. Confidential Information of ngrok
OpenID Connect FTW

41. © ngrok. All rights reserved. Confidential Information of ngrok
OpenID Connect

42. © ngrok. All rights reserved. Confidential Information of ngrok
OIDC: Opinionated Structure
● openid
● profile
● email
● address
● phone
● name
● given_name
● email
● street_address
● phone_number
And many more..

43. © ngrok. All rights reserved. Confidential Information of ngrok
● RFC 6749 OAuth Core
● RFC 7519 JSON Web Token
● RFC 7662 Token Introspection
● RFC 7009 Token Revocation
● OpenID Connect Specification
● RFC 8414 Authorization Server Metadata Discovery
More Pieces!

44. © ngrok. All rights reserved. Confidential Information of ngrok
● RFC 6749 OAuth Core
● RFC 7519 JSON Web Token
● RFC 7662 Token Introspection
● RFC 7009 Token Revocation
● OpenID Connect Specification
● RFC 8414 Authorization Server Metadata Discovery
More Pieces!
The second most
important RFC of all

45. 06
Closing Thoughts

46. © ngrok. All rights reserved. Confidential Information of ngrok
© ngrok. All rights reserved. Confidential Information of ngrok
“We support OAuth”
is a meaningless statement

47. © ngrok. All rights reserved. Confidential Information of ngrok
© ngrok. All rights reserved. Confidential Information of ngrok
“We support OpenID Connect”
is useful (for SSO)

48. © ngrok. All rights reserved. Confidential Information of ngrok
© ngrok. All rights reserved. Confidential Information of ngrok
Figure out which combo of
specs you need & they have
*RFC 8414 is your best friend

49. © ngrok. All rights reserved. Confidential Information of ngrok
01 Intro
02 OAuth Vocabulary
03 The Grant Types
04 Which one when?
05 The fun pain truth lies multitude of specs
06 Closing / Q&A
Recap

50. Thank you

51. The Many
Layers Of OAuth
Danger Casey
API Problem Solver, GTM Guy, General Nuisance
danger@ngrok.com
May 2023