1. The document discusses OAuth2 and OpenId Connect which were developed to address identity use cases like simple login, single sign-on, and mobile app login. 2. It explains how OAuth2 works using authorization codes and access tokens to delegate access from a client to a resource server, and security extensions like PKCE. 3. OpenId Connect builds upon OAuth2 by adding an ID token for authentication purposes along with user profile and logout requests to support identity features that OAuth2 was not designed for.

1. OAuth2 + OpenId: Rear, Medium,
Well Done
Sergiy Mokiyenko
Android developer

2. It ain’t what you don’t know that gets you into trouble.
It’s what you know for sure that just ain’t so.
Mark Twain

3. Identity use cases (2007)
• Simple login
• Single sign-on across sites (SAML)
• Mobile app login
• Delegated authorization

4. Simple Login or form authentication
Set-Cookie: sessionid=adfhrs4f5; Max-Age: 86400;

5. Downsites

7. OAuth 2.0

8. Client
Authorization server
Permissions consent
Resource server
Client

9. Redirect URI: yordomain.com/callback
Response type: code
Scope: profile, contacts
Back to redirect URIaccessToken: dFGDFDsdas45
Talk to resource server
with access token
Exchange authorization code
for access token

10. Front channel
Back channel

11. Redirect URI: yordomain.com/callback
Response type: code
Scope: profile, contacts
Back to redirect URI
with codeaccessToken: dFGDFDsdas45
Talk to resource server
with access token
Send
codeto
back
channel
Exchangecodefor
tokensusing
C
lientSecret
Send
tokens
Client ID: “yourClientId”

12. PKCE
Authorization request + t(code verifier)
Authorization code
Token request + code verifier
Tokens

13. Redirect URI: yordomain.com/callback
Response type: code
Scope: profile, contacts
Back to redirect URIaccessToken: dFGDFDsdas45
Talk to resource server
with access token
Exchange authorization code
for access token using
code challenge
Code challenge, hashing algorithm

14. OpenId Connect

15. Identity use cases (pre-2014)
• Simple Login (OAuth 2.0)
• Single sign-on across sites (OAuth 2.0)
• Mobilу app login (OAuth 2.0)
• Delegated authorization (OAuth 2.0)
Authentication
Authentication
Authentication
Authorization

16. What is wrong with OAuth 2.0
OAuth is not meant for Authentication but for Authorization

17. OAuth 2.0
OpenId Connect
• Adds IвToken
• Adds user profile request to the standard
• Adds logout request to the standard (Still in test)

18. Let’s see how it works