I am planning to leverage spring security to implement a mix of Oauth (Jwt) token based with ABAC ( attributed based access control model). The ABAC is introduced in spring 5. I have looked at the implementation, but I am struggling to integrate seamlessly with Oauth token.
Appreciate for any advice?
Related
As far as I understand, applications that we can login with our different accounts use OpenID Connect(A profile of OAuth2.0).
OAuth is for Authorization and OIDC is for authentication(It has ID Token-User Info Endpoint).
So, was it not possible to login to an application from another application account using OAuth before OIDC? (If possible, how?)
If plain OAuth can't be used for authentication, what is/was it used for?
I mean what does it do with 'authorization' exactly?
What does it get from the resource service with the access token?
I have always found the jargon around this unhelpful so I understand your confusion. Here is a plain English summary:
OAuth 2.0
Before OIDC apps used OAuth 2.0 to get tokens, and this involved optional user consent. The process of getting tokens was termed 'delegation'.
In practical terms though all real world OAuth 2.0 providers also included authentication in order for their system to be secure. How authentication was done is not defined in OAuth specifications.
OAuth is primarily about protecting data, where scopes and claims are the mechanisms. These links provide further info:
IAM Primer
Scope Best Practices
Claims Best Practices
OIDC
This just adds some clearer definition around how authentication messages before and after authentication should work:
A client simply includes an openid scope to use OpenID Connect
A client may force a login during a redirect via a prompt=login parameter
A client may request an authentication method via an acr_values parameter
The client receives an ID token (assertion) once authentication is complete, can digitally verify it if required, then use the information in it (eg a user name)
OIDC still does not define how the actual authentication works though.
Use them together
Pretty much all OAuth secured apps (and libraries) these days use both together, so that the authentication and delegation both use standards based solutions. It gives you the best application features and design patterns for doing the security well.
I am trying to enable OIDC authN and authZ workflow for my spring-java-web application. Ideally I wanted to do it in a IDP agnostic way.i.e.This application could be integrated with only and any one of the Azure AD,OKTA,AWS SSO,Google-auth by deployment admin.And I want users to be redirected to whatever provider the application is integrated with.
With OIDC as a standard, my understanding is i should be able to write a OIDC auth processing filter that should work with any of the providers. The necessary config that varies per provider ( auth url,client id,secret,JWKS url to get the provider keys etc) will be passed to this filter/rest template as parameters.
Q.1 Is it possible to implement provider agnostic OIDC filter? Can someone give any pointers?
I am aware that Spring natively provides Oauth2 libraries/apis like AuthorizationCodeResourceDetails, OAuth2ClientAuthenticationProcessingFilter . However I do not see any OIDC native processing filter in built. Is there any?
I tried and understood the workflow as given in https://www.baeldung.com/spring-security-openid-connect .However when i try to tweak this code to make it work with Azure AD it fails. Thats because Azure AD requires
The response_type parameter must include id_token.
The request must include nonce parameter to be set in request.
AuthorizationCodeResourceDetails does not support such param. Given that OIDC is a common standard ,
Q-2. I fail to understand why every provider still has different requirements? Doesn't it defeat the purpose of OIDC . Infact I read that google throws error if you pass nonce
Q-3. Are there any spring native ways to configure these additional provider specific params like nonce , promt, additional response-type ,preferable with examples?
I think your problems with Spring Security OIDC are that you're using the legacy OAuth library (at least that's what the baeldung article is illustrating). OAuth2 and OIDC are part of Spring Security 5.x now and not a separate project. There's an OIDC client "login-client" in this example: https://github.com/jgrandja/oauth2-protocol-patterns that might show different. Yes, OIDC should allow you to swap providers in and out although not all OIDC providers will implement everything (e.g. discovery, etc.)
When I am trying to understand OAuth2 client, I am confused about why we have two different filters
I attempted to integrate with Github. Here are my observations
OAuth2AuthorizationCodeGrantFilter sound like a filter that exchanges authorization code for access token, but when I keep debug point it does not do that
OAuth2LoginAuthenticationFilter sounds somewhat like it does login somehow, but this filter exchanges auth code to access token instead of above
I'm not sure why this is the case, as the first class name implies some strong correlation to authorization code
Also, Whats is the difference between OAuth2LoginConfigurer & OAuth2ClientConfigurer
Looks like OAuth2LoginConfigurer configures OAuth2LoginAuthenticationFilter, while OAuth2ClientConfigurer configures OAuth2AuthorizationCodeGrantFilter
Can someone explain what each of them does & in which scenarios they are applicable?
Thanks
This is well documented in the Spring Security reference.
OAuth 2.0 Login
OAuth 2.0 Client
As well, in the javadoc:
OAuth2LoginAuthenticationFilter
OAuth2AuthorizationCodeGrantFilter
At a high level:
http.oauth2Login() is an implementation of OpenID Connect Authentication using the Authorization Code Flow
http.oauth2Client().authorizationCodeGrant() is an implementation of OAuth 2.0 Authorization Code grant
We'd like to add Oauth2 support for a spring mvc and spring security based web application, so the oauth2 security module (http://www.buynfctags.com/nfc-tags/stickers/printed-nfc-sticker-ntag.html) seems a great fit.
But which flows exactly are supported? The docs only list the web-server flwo, but what about client-side and resource owner password flow for example. Will it work out of the box?
All the main OAuth2 flows are supported - authorization-code, implicit, client-credentials and password. There is more information in the github wiki and you might also want to take a look at the authorization-server element in the namespace schema.
The CloudFoundry UAA project is a useful example of using Spring Security OAuth2 in practice.
We are building a REST API using ASP.NET MVC. This API is similar in principle and usage to the Factual v3 API. They use 2-legged Oauth 1 for their API. Our design is very similar in that applications, primarily mobile will use our API behind the scenes to provide a service. The end user of the application will not know about our API, and will therefore not have any credentials. So redirecting the user via a browser window to an auth form (like facebook) does not make any sense. My questions are..
Why OAuth2 flow is the best to use in this scenario?
Should we even use Oauth2 or just stick with 2-legged OAuth 1?
For reference we are using C#/.NET, ASP.NET MVC 3 and plan on using DotNetOpenAuth v4.
http://developer.factual.com/display/docs/Factual+Developer+APIs+Version+3
Why OAuth2 flow is the best to use in this scenario?
It isn't, necessarily. OAuth 2 is an unfinalized spec. If you need maximum interoperability, OAuth 1.0 is the better choice (for now). OAuth 2 is simpler for the client, at the expense of significantly added complexity on the server.
Should we even use OAuth2 or just stick with 2-legged OAuth 1?
Use the pros and cons listed above to choose. And also that if you're using DotNetOpenAuth, OAuth 1.0 support has been around for years whereas OAuth 2.0 support isn't fully baked yet so you'd probably hit some road bumps.
Try this:
http://community.codesmithtools.com/CodeSmith_Community/b/tdupont/archive/2011/03/18/oauth-2-0-for-mvc-two-legged-implementation.aspx