Questions tagged [openid-connect]
OpenID Connect is an optional standardization of identify and profile data on top of OAuth 2.0 when OAuth is used for authentication.
113
questions
0
votes
1answer
61 views
OIDC: should the provider have the same address as the issuer?
I'm using Coreos OIDC library for Go. When setting up an OIDC config (coming from PROVIDER_URL/.well-known/openid-configuration), I'm getting this error:
Could not initialize OIDC provider:oidc: ...
1
vote
0answers
66 views
Designing distributed authentication/authorisation system
I'm trying to design a system that has the following elements:
the main backend REST API (currently one, probably multiple in the future)
front-channel client(s) -- JS-based single-page app(s)
back-...
2
votes
2answers
97 views
Attacker models of long-term logins: how should sensitive server endpoints require re-authentication?
Let's see the following scenario:
"GutHib" is a fictional hosting service in the form of an online webapp for the fictional DVCS software "Gut".
Alice logged in to GutHib with her password and 2FA, ...
0
votes
0answers
38 views
OIDC SPA Keycloack refresh_token storage location
I have Single Page Application based on Open ID Connect flow (keycloak).
I wonder what are the security considerations for refresh token storage - what are the advantages and disadvantages for ...
0
votes
0answers
39 views
JWT Authentication and authorisation for B2B systems
We are planning to use openID connect to protect our B2B REST endpoints(backend servers).
For the sake of simplicity naming our back-end servers as A and B
Step 1, to protect server A, Server A ...
0
votes
0answers
40 views
Having one OIDC provider and multiple APIs from third parties, how can I federate logins?
If I have an app which authenticates against one OIDC provider eg. Google but then uses the provided id- and access-token to make request against a 1. app-api and 2. a third-party-api using the tokens ...
1
vote
0answers
29 views
Oauth2/OIDC: I know the address of a resource server, is there a standard for querying which authorization servers it accepts?
I have a bunch of what are essentially IOT devices that will authenticate connections using oauth 2 tokens and/or openid connect (depending on use-case). Each IOT device is individually configurable ...
0
votes
0answers
55 views
OpenId Connect Authorization Code Flow in Microservice Scenario (API-Gateway?)
Im building a SPA with a couple of backend-microservices and i want to authenticate using OIdC.
I'm aware of the fact that the implicit flow is not recommended anymore for this. So the recommended ...
0
votes
1answer
16 views
Can a service be Oauth2 provider and Oauth2 client at the same time?
Let's say a new application X is an Oauth2 client and allows it's user to signup/login with other Oauth2 providers like Google. So a user U signs up using Google and regularly logins using Google to ...
2
votes
1answer
59 views
Are there documented best practices when federating identity to a third party using OIDC?
We are creating an OpenId Provider (using Identity Server 4) that has the ability to federate authentication to other IdPs based on email (eg, we first ask for email and then determine how to ...
0
votes
0answers
24 views
OIDC Protocol :: Different OIDC Server End points
OIDC Specifications:
Authorization Code Grant Flow.
As OIDC Server is shall list the various end points (Auth EP, Token EP, Token validation EP etc.)
In this scenario, Can Auth End Point and Token End ...
2
votes
2answers
141 views
Microservices and RBAC using OIDC
I am currently working on migrating our users from an internal DB to an OIDC service (considering Cognito/Auth0/etc.), and I am trying to implement RBAC.
Our backend is basically a bunch of ...
0
votes
0answers
106 views
Using Cognito access token to pass claims
I am working on migrating all our users from our DB to a managed service, and we're considering AWS Cognito.
We want to use Cognito for Authentication and Access Control.
For access control, we're ...
1
vote
1answer
330 views
OpenID Connect: Is storing access token in browser secure?
I'm currently in the phase of integrating my web-site to OpenID Connect provided by KeyCloak. The web-site is not a single page application. However, different parts of the application are delivered ...
0
votes
0answers
39 views
Is it ok to forward a JWT between two custom services?
I'm using Azure AD Implicit Flow for authentication between a SPA and a WebApi.
I want to know if it would be ok/save to redirect from the SPA to a intermediary service of my own as well with the ...
0
votes
0answers
34 views
Do I have to use two OAuth/OpenIdConnect bearer token with PKCE?
We have some REST APIs exposed to public applications. Those applications are registered with an (application protocol scheme) redirect URL and we provide to the developer a client secret and client ...
3
votes
0answers
45 views
Architecting a solution with native login and 3rd party login via OAuth/OpenID Connect using dotnet core
I am building an API driven application that will have a native login with username and password, and will also need to grant 3rd party access via OAuth/OpenID Connect in the near future.
A pattern I ...
2
votes
1answer
56 views
Is re-prompting a user for credentials an effective measure to prove a user's identify
I'm upgrading the authentication of an application from self hosted forms authentication to OpenID Connect through Azure Active Directory B2C (AAD B2C) and have found a few pages which re-prompt the ...
0
votes
1answer
66 views
SSO authentication & authorization architecture/implemenation
We got a bunch of different services (SPAs + API GW, legacy JavaEE apps, etc.). Each of those is usually ran in multiple instances (customer specific instances). The plan is to federate them under a ...
1
vote
1answer
154 views
Did I get it right? OAuth2, OpenID and OpenID Connect
After a lot of research about authentication and authorization, I reached the following but not sure if what I reached is the correct thing so please help me out:
Authentication is who you are. ...
0
votes
1answer
56 views
Is it safe to just forget OAuth tokens, and not invalidate them in a mobile app?
I have a mobile application that a user signs into using OpenId Connect and OAuth 2.0. Currently when the user logs out, I open up a webpage to the end_session_endpoint (http://docs.identityserver.io/...
1
vote
2answers
52 views
Is it dangerous not to verify the signature of an id token issued by an external authorization server?
I need to retrieve some values from an id token issued by an external authorization server inside a private network.
I asked for the certificate used to sign the jwt in order to verify it but I've ...
1
vote
1answer
237 views
How can I securely disable CSRF validation for native clients when browser clients access the same API?
I have an API endpoint that is accessible by both native (console, mobile apps) and Javascript based clients.
How do I ensure that the CSRF AntiForgeryToken is only invoked during Javascript calls?
...
1
vote
1answer
78 views
Is it a good idea to notify a user that they signed up with a social-login account?
Say my website provides three main ways to signup/signin: Google, Facebook and typical username/password. Is it a good idea to flash "Please login using your Google account" if a user tries to login ...
1
vote
0answers
369 views
OpenID connect authentication with cookie authentication middleware [Asp.Net MVC ]
In my ASP.NET MVC based application I am using 'OpenID connect authentication' middleware with 'cookie authentication middleware' (session/transient cookie).
While accessing the application I ...
1
vote
1answer
137 views
JWT access tokens: Too much information?
I've recently encountered the practice of systems using JWTs as Access Tokens. I have a concern and I'm not sure if it's unfounded:
I associate JWTs with the OpenID Connect protocol, where there are ...
1
vote
1answer
41 views
What are the pieces of information delivered in a user profile at the end of a OpenID Connect flow?
From what I understand about using OpenID Connect (over OAuth2), is that we end up with some JSON containing information about the user. That information is transported as a JSON Web Token.
➥ What ...
2
votes
1answer
57 views
What is the proper flow for authentication?
I'm tasked with migrating a group of .Net WebForms applications from a current custom username/password login scheme to an oauth2/openid connect based authentication and authorization. This specific ...
1
vote
1answer
553 views
MS Active Directory vs OpenId Connect?
I have to setup a user authentication system which shall be used for more than one application. Coming from Windows background, Microsoft Active Directory came to mind naturally.
But I have heard ...
2
votes
1answer
88 views
How to properly deal with different user-facing login mechanisms?
I'm wondering if it's possible to deal with a login mechanism that is dependent on the user identifier.
For example, the user can have access using OpenId, OAuth or token. But how can we "help" the ...
1
vote
1answer
40 views
How does the authorization work after authentication using OpenID Connect
Suppose that a client gets an ID token and access token from the auth server after successful authentication. The client now sends a request to the application server (request contains access token ...
1
vote
1answer
77 views
Is Browser based flows required for most IdP based Authentication standards?
I'm going to apologize in advance for the rambling nature of this question, I've read a lot about SAML and OIDC and other standards, just trying to understand why browsers seem to be so essential for ...
2
votes
1answer
146 views
OIDC Hybrid flow
I'm trying to understand the Hybrid flow of OIDC. Am I correct in thinking that an authentication request is made to the authorization endpoint, which then responds with the authorization code, id ...
1
vote
1answer
161 views
Bypassing OpenID Connect audience claim with implicit grant
As an example, let's look at how authentication works with Kubernetes:
Specifically, let's focus on what the api server does. To authenticate the request, it:
Verifies that the JWT signature is ...
2
votes
1answer
228 views
Authorization on OAuth2 application that is both Client and Resource Server
I am trying to understand how would an application which uses OAuth2 (OIDC) server implement access control to its own resources.
In this case, the application is both 'Client' and 'Resource server' ...
2
votes
0answers
686 views
Auth0 vs Firebase = oidc vs Firebase Tokens
I am trying to choose between Auth0 and Firebase as my identity provider. I am building a SPA with a Backend API and I would like to use Auth0 or Firebase for all the logic regarding users/passwords/...
1
vote
1answer
149 views
OIDC - what is the point of two separate tokens - access and id?
I struggle to understand why don't we just have a single token that serves both purposes - authorisation and authentication?
In some sense, the access token does more than just authorisation. It also ...
3
votes
0answers
804 views
Token Exchange at a REST API Gateway to federate authentication while maintaining detailed authorization (think ABAC) within the API?
I'm on the verge of creating a service within our resource server that would exchange an externally generated access token for an internally generated access token. However, this feels wrong. I have ...
2
votes
1answer
2k views
Why does OpenID Connect (“OIDC”) use a `nonce` claim instead of the `jti` registered claim
According to the spec, OpenID Connect uses nonce as the registered claim name, but RFC 7519 already includes a registered claim named jti for this same purpose.
Was this an oversight, or was there ...
2
votes
0answers
125 views
Web application making a call to a REST API when already authenticated
I'm new to ASP.NET Core and OpenID connect/AzureAD, so I'm looking for some validation (or otherwise) of my approach. Extensive reading/googling over the last couple of weeks while I've been learning ...
3
votes
0answers
316 views
Is passing claims about the user in an access token “abusing” OpenID Connect?
First, let me assure you that I have read a number of posts on the topic before asking this question, but I am still confused and would appreciate more insights.
So, here's the premise:
There is a ...
0
votes
1answer
57 views
Non-standard OIDC flow: How safe is this?
I have been made aware of an application, at a client, that claims to use OIDC to authenticate users. This is however done via a non-standard flow that I find hard to assess from a security standpoint....
2
votes
1answer
1k views
Implicit flow login from SPA
Looking at the implicit flow to login with https://github.com/IdentityModel/oidc-client-js and https://github.com/IdentityServer/IdentityServer4.Samples/tree/release/Quickstarts/7_JavaScriptClient . ...
22
votes
4answers
8k views
Why isn't PKCE encouraged for Single-Page Apps?
A lot of services today still recommend the implicit flow for an OpenID Connect/Oauth2 token exchange when developing Single-Page Apps. (See Okta, Google, Auth0)
Some newer guidance out there points ...
2
votes
1answer
210 views
OpenID Connect, OAuth2, and deleted accounts
If I use OpenID Connect or OAuth2 for authentication, and a customer deletes his/her OAuth2 provider (Facebook) account, how can I safely associate a new authentication with a different OAuth2 ...
2
votes
0answers
96 views
OAuth2 Implicit Flow. Additional protection for access_token from interception
We have a one-page JavaScript application that authenticates the user on our server using the OAuth 2.0 protocol (and the AddId-Connect add-in). After authentication, the server issues an access_token ...
1
vote
0answers
325 views
OAuth2 Implicit Flow and silent autologin by Windows Identity. Possible new attack vectors?
We have a typical Single-Page js application that authenticates to our own authentication server using the OAuth 2.0 protocol (and the OpenId-Connect add-in). The customer sent a request to implement ...
2
votes
0answers
902 views
Protecting frontend code for SPA + Restful API with OIDC
I've got an Angular 1 SPA with a Restful API that I'd like to restrict access to. As I understand, typically the OIDC Implicit flow is designed just for this. However, I consider the frontend SPA code ...
1
vote
2answers
87 views
Does the OpenID Connect Core specification incorrectly define the OpenID Provider and Relying Party in terms of human participants?
There are a few important definitions in the OpenID Connect Core specification that refer to a human participant, and at first glance it would seem that OpenID Connect only applies in cases where ...
3
votes
2answers
189 views
How can an end-user verify the authenticity of a third-party authentication provider's login form
Given the ubiquitous use of third party authentication providers in web apps today, how can end-users verify the authenticity of the login forms that collect their credentials? What's to stop a ...
