1. INF 123 SW ARCH, DIST SYS & INTEROP LECTURE 16 Prof. Crista Lopes

2. Objectives  Understanding the difference between Authentication and Authorization  Understanding OpenID and OAuth

3. Auth vs Auth  Authentication: who is this user?  Authorization: can this user do that?

4. Identity on the Web  Millions of Web sites, each with their own users  Each user needs to remember N usernames+passwords  …why not interoperate identity?  …why not interoperate more data?

5. Decentralized Identity OpenID

6. OpenID in Action  “OpenID is a decentralized authentication protocol that makes it easy for people to sign up and access web accounts.”  www.stackoverflow.com www.stackoverflow.com

7. How it works http://yahoo.com http://openid.net/developers/specs/

8. How it works, in 11 steps http://www.windley.com/archives/2006/04/how_does_openid.shtml Relying party OpenID Provider End Point

9. Steps 1, 2 – Post Identifier

10. How it works – Discovery http://www.windley.com/archives/2006/04/how_does_openid.shtml Relying party OpenID Provider End Point

11. Steps 3, 4 – Normalization & Discovery  Yadis Protocol Content-Type: application/xrds+xml when performing an HTTP GET on the identity URL

12. Step 3 – XRDS response <xrds:XRDS xmlns:xrds="xri://$xrds" xmlns="xri://$xrd*($v*2.0)" xmlns:openid="http://openid.net/xmlns/1.0"> http://openid.net/signon/1.0 http://www.myopenid.com/server http://smoker.myopenid.com/ http://openid.net/signon/1.0 http://www.livejournal.com/openid/server.bml http://www.livejournal.com/users/frank/ http://lid.netmesh.org/sso/2.0 http://mylid.net/liddemouser http://lid.netmesh.org/sso/1.0

13. Steps 3, 4 – Normalization & Discovery  Plain HTTP  Returned document must contain a element:

14. How it works – Redirect 1 http://www.windley.com/archives/2006/04/how_does_openid.shtml Relying party OpenID Provider End Point

15. Step 5 – First redirect  Relying party parses XDSR or and retrieves the OpenID provider end point.  Then redirects (302, 303 or 307) user agent to it with query params appended to the URL: HTTP/1.1 303 See Other Location: https://login.yahoo.com? openid.ns=http://specs.openid.net/auth/2.0& openid.mode=checkid_setup& openid.claimed_id=e_mumble& openid.return_to=http://stackoverflow.com?article=123

16. How it works – Login http://www.windley.com/archives/2006/04/how_does_openid.shtml Relying party OpenID Provider End Point

17. Steps 6, 7, 8, 9 – Login  Undefined in the Spec  Usually regular login form with POST  May include further verification with user  This is a vulnerable point in the process  more later

18. How it works – Final Redirect http://www.windley.com/archives/2006/04/how_does_openid.shtml Relying party OpenID Provider End Point

19. Step 10 – Final Redirect  OpenID Provider End Point redirects user agent back to the “return_to” URL. HTTP/1.1 303 See Other Location: http://stackoverflow.com?article=123? openid.ns=http://specs.openid.net/auth/2.0& openid.op_endpoint=https://login.yahoo.com& openid.return_to=http://stackoverflow.com?article=123& openid.identity=e_mumble& openid.response_nonce=2005-05-15T17:11:51ZUN6TY9& openid.sig=MACsignature

20. Step 10  Relying party must verify a few things before deciding that the user is authenticated  return_to matches  identifier matches  nonce is unique  signature is valid

21. How it works – Finally! http://www.windley.com/archives/2006/04/how_does_openid.shtml Relying party OpenID Provider End Point

22. Step 11  Relying party returns the page that user was on  http://stackoverflow.com?article=123

23. Final Remarks  The whole point of OpenID is to authenticate users  your web app wants to verify that user jonh.smith @ yahoo.com really is john.smith at yahoo.com  OpenID knows nothing about authorization  after establishing identity, your application must deciding which resources this user is allowed to access authentication ≠ authorization

24. OpenID is Phishing Heaven  idtheft.fun.de  OpenID’s adoption by major sites is a mystery to me!

25. Authorization – but not for *your* resources OAuth

26.  The goal of OAuth is to acquire an access token from a 3 rd party (like Google, Facebook, etc.), which can then be used to exchange user-specific data between your application and that 3 rd party service (such as calendar information or friends list) Facebook/Google user data Your app access user data

27. OpenID+OAuth  Lets arbitrary apps (like yours) access your Twitter/Facebook/Google/etc account without having to have your password

28. OAuth 4 main steps  Your app asks for a “request” token from the 3 rd party  Your app asks the 3 rd party for the token to be authorized  3 rd party requests user approval  Your app exchanges the “request” token for an “access” token  Your app uses the “access” token to access the data