Introduction to OpenID Connect and OAuth
OpenID Connect and OAuth are the de-facto standards for authentication and authorization in modern applications, yet they involve complex concepts like scopes, claims, and token flows.
.jpg?quality=85)
Kursdatoer er ikke helt avklart ennå, men kontakt kurs@bouvet.no for påmelding!
This introductory workshop simplifies these fundamentals, giving developers, testers, and architects the skills to implement secure identity solutions. With hands-on exercises and practical insights, participants will gain a solid foundation to prevent vulnerabilities and work confidently with systems like Duende IdentityServer, Keykloak, and Entra ID.
What you will learn
- Authentication vs. authorization
- How OAuth 2.x and OpenID Connect work
- Fundamental concepts
- How a client authenticates against an authorization server
- How to retrieve and consume JWT tokens
- How OpenID Connect fits into your architecture
- How the tokens are secured and managed
This course includes many hands-on exercises that will help you understand how the protocol works under the hood.
After this course, we recommend taking the Web Security Fundamentals workshop. Understanding core web security concepts is crucial when implementing and working with authentication solutions.
Who Is This For?
This course is designed for both new and experienced developers and architects seeking to understand the fundamentals of application security using OAuth2 and OpenID Connect. With a focus on the core standards and protocols rather than a specific implementation or programming language, it’s the perfect fit regardless of whether you use Duende IdentityServer, Entra ID (AzureAD), KeyCloak, or any other authorization service.
Prerequisites
- You should have a good understanding of the following:
- The HTTP(s) protocol (including methods, headers, and cookies…)
- How the web works in general.
- Familiar with REST APIs and JSON
- Some experience in developing backend web solutions
Kursdatoer er ikke helt avklart ennå, men kontakt kurs@bouvet.no for påmelding!
Agenda
- Authentication vs. Authorization
- Our challenges
- OAuth versions
- OAuth vs. OpenID Connect
- Authorization Server
- Relying party
- Token types
- Bearer token
- Server implementations
- Identity architecture
- Service endpoints
- The discovery document
- How does this flow work
- Why it is no longer a recommended flow
- ID and access tokens
- JSON Web Tokens
- JWT access tokens
- What are claims?
- Claim types
- Scopes
- User consent
- Unsecure tokens
- Signed tokens
- Signature algorithms
- Private/public keys
- Encrypted tokens
- State and nonce
- Public vs. private clients
- Front vs. back-channel
- Getting the tokens
- One-time refresh tokens
- Using the refresh token
- Token introspection
Proof Key for Code Exchange (PKCE)
Ønsker du å samle flere ansatte til et bedriftsinternt kurs?
Finner du ikke det helt optimale kurset eller kombinasjonen av kurs? Da ordner vi det - sammen. Vi kan tilrettelegge kurs slik at de inneholder akkurat det dere har behov for. Vi kan sette opp et helt nytt kurs, eller tilpasse eksisterende kurs og materiell. Flere medarbeidere kan selvfølgelig også samles til et eget felles kurs, for maksimal effektivitet. Ta kontakt med meg for et forslag til gjennomføring og et tilbud basert på deres behov.
