Questions tagged [openid-connect]

OpenID Connect is an optional standardization of identify and profile data on top of OAuth 2.0 when OAuth is used for authentication.

Filter by
Sorted by
Tagged with
0
votes
1answer
32 views

OpenID Connect with Authorization code flow and PKCE - How shoud we get a new access token in a SPA application?

As answered in this question, Single Page Applications shouldn't be given a refresh token with the OIDC Authorization Code Flow. Can you indicate some way of getting a new access token when it ...
0
votes
1answer
61 views

oidc authentication webapp REST api

So I have looked at the following client library, implementing the OpenID Connect spec: https://github.com/IdentityModel/oidc-client-js It works as expected, and I can now allow users to login with ...
3
votes
1answer
51 views

How exactly do mobile apps achieve authorization code flow with PKCE?

Let's imagine the following: I've developed a mobile app using Xamarin (iOS/Android compatible) I want it to support OAuth2 + OpenID connect's authorization code flow with PKCE, so that the user's ...
1
vote
0answers
37 views

OpenID Authentication Method Reference Name for a code sent via email

Introduction: I am currently implementing acr_values, acr & amr principles on a Open ID Provider server. The claim amr (described in the OpenID RFC 1.0) has no standard clearly defined in this ...
1
vote
1answer
53 views

How verify id_token from the browser in OAuth2?

I have been dwelling into OAuth2 and and OpenID Connect for Authorization flow. And I'm still a bit confused. I do understand that during the code exchange for an access token the user receives an ...
1
vote
2answers
67 views

How to report error if redirect_uri doesn't match?

How should the auth server (IDP) report the error if the authorisation request redirect_uri doesn't match the configured redirect_uri for the given client? Let's consider concrete example: auth.com ...
0
votes
1answer
66 views

Use OpenID Connect for authentication and custom authorization

I'm working on a service where I want to protect endpoints from unauthorized access, but I don't want to deal with user management. This is how I found the OpenID Connect which I would like to use ...
2
votes
1answer
35 views

oidc: do I have to verify the id token if I only use the access token?

today we've had an interesting question over a coffee: If I would implement my own client security for openID connect and use the authorization code grant - do I have to verify the ID-Token if I only ...
0
votes
1answer
56 views

Is OpenID Connect implicit flow safe to use?

In researching OAuth 2.0, I see that implicit grant is no longer recommended:- In order to avoid these issues, clients SHOULD NOT use the implicit grant (response type "token") or any other ...
1
vote
1answer
170 views

PKCE vs Client Secret

If I was developing a web app client that would be served statically, I would need to either use the implicit grant flow (which is no longer advisable) or use the authorization code grant flow with ...
0
votes
0answers
26 views

Apps removing their permissions in OAuth

We are designing a web application for a customer and the main use case is that users will be using the system for anywhere between a few days and a few months. The customer would like to offer users ...
0
votes
1answer
135 views

How important is the JWKS endpoint in OpenID Connect?

Our security is changing, so I'm updating an Angular SPA application to use OpenID Connect. I found a nice library to help set things up. However, I've run into an issue where it tries to access the ...
1
vote
1answer
105 views

OpenIdConnect: Is there an advantage to using code flow over implicit flow with form_post?

Background: a traditional webapp with a server backend and 3rd party sign in. For this we get a validated id_token on our backend from the 3rd party, use that to identify an account in our system, and ...
0
votes
1answer
64 views

Validating iss and aud for internally signed JWT

I have an identity service that issues JWTs that are signed with private key. I have several resource services that consume that token to determine the claims of the user and thereby to determine ...
2
votes
0answers
112 views

OpenID Connect Web Message Response Mode and XSS

When using the web message response mode spec with OpenID Connect for silent authentication, what prevents an attacker leveraging an XSS attack from registering a "message" listener and intercepting ...
1
vote
1answer
222 views

What are the security implications using a Refresh Token in a SPA using Authorisation Code Flow + PKCE

I am considering moving my SPA from Implicit flow to Authorization Code + PKCE extension. This new flow will provide the SPA with a Refresh Token that doesn't expire. Let's say a malicious user on ...
0
votes
0answers
38 views

OAauth - Authorize Vs Token Routes

Although I read about the differences between the token route and the authorized route I am not sure exactly when I need to use them. If I understand correctly the /authorize will be used for clients ...
0
votes
0answers
33 views

OAauth - When To User Refresh Token?

I understand the role of refresh token but I'm not sure when it is enough to provide only access token and when need to provide both access token and refresh token? For example, if a user login to my ...
0
votes
1answer
99 views

OIDC: should the provider have the same address as the issuer?

I'm using Coreos OIDC library for Go. When setting up an OIDC config (coming from PROVIDER_URL/.well-known/openid-configuration), I'm getting this error: Could not initialize OIDC provider:oidc: ...
1
vote
0answers
69 views

Designing distributed authentication/authorisation system

I'm trying to design a system that has the following elements: the main backend REST API (currently one, probably multiple in the future) front-channel client(s) -- JS-based single-page app(s) back-...
2
votes
2answers
110 views

Attacker models of long-term logins: how should sensitive server endpoints require re-authentication?

Let's see the following scenario: "GutHib" is a fictional hosting service in the form of an online webapp for the fictional DVCS software "Gut". Alice logged in to GutHib with her password and 2FA, ...
0
votes
2answers
125 views

OIDC SPA Keycloak refresh_token storage location

I have Single Page Application based on Open ID Connect flow (keycloak). I wonder what are the security considerations for refresh token storage - what are the advantages and disadvantages for ...
0
votes
0answers
44 views

JWT Authentication and authorisation for B2B systems

We are planning to use openID connect to protect our B2B REST endpoints(backend servers). For the sake of simplicity naming our back-end servers as A and B Step 1, to protect server A, Server A ...
0
votes
0answers
72 views

Having one OIDC provider and multiple APIs from third parties, how can I federate logins?

If I have an app which authenticates against one OIDC provider eg. Google but then uses the provided id- and access-token to make request against a 1. app-api and 2. a third-party-api using the tokens ...
1
vote
0answers
36 views

Oauth2/OIDC: I know the address of a resource server, is there a standard for querying which authorization servers it accepts?

I have a bunch of what are essentially IOT devices that will authenticate connections using oauth 2 tokens and/or openid connect (depending on use-case). Each IOT device is individually configurable ...
0
votes
0answers
177 views

OpenId Connect Authorization Code Flow in Microservice Scenario (API-Gateway?)

Im building a SPA with a couple of backend-microservices and i want to authenticate using OIdC. I'm aware of the fact that the implicit flow is not recommended anymore for this. So the recommended ...
0
votes
1answer
19 views

Can a service be Oauth2 provider and Oauth2 client at the same time?

Let's say a new application X is an Oauth2 client and allows it's user to signup/login with other Oauth2 providers like Google. So a user U signs up using Google and regularly logins using Google to ...
3
votes
1answer
121 views

Are there documented best practices when federating identity to a third party using OIDC?

We are creating an OpenId Provider (using Identity Server 4) that has the ability to federate authentication to other IdPs based on email (eg, we first ask for email and then determine how to ...
0
votes
0answers
30 views

OIDC Protocol :: Different OIDC Server End points

OIDC Specifications: Authorization Code Grant Flow. As OIDC Server is shall list the various end points (Auth EP, Token EP, Token validation EP etc.) In this scenario, Can Auth End Point and Token End ...
2
votes
2answers
572 views

Microservices and RBAC using OIDC

I am currently working on migrating our users from an internal DB to an OIDC service (considering Cognito/Auth0/etc.), and I am trying to implement RBAC. Our backend is basically a bunch of ...
1
vote
0answers
328 views

Using Cognito access token to pass claims

I am working on migrating all our users from our DB to a managed service, and we're considering AWS Cognito. We want to use Cognito for Authentication and Access Control. For access control, we're ...
1
vote
1answer
768 views

OpenID Connect: Is storing access token in browser secure?

I'm currently in the phase of integrating my web-site to OpenID Connect provided by KeyCloak. The web-site is not a single page application. However, different parts of the application are delivered ...
0
votes
0answers
39 views

Is it ok to forward a JWT between two custom services?

I'm using Azure AD Implicit Flow for authentication between a SPA and a WebApi. I want to know if it would be ok/save to redirect from the SPA to a intermediary service of my own as well with the ...
0
votes
0answers
38 views

Do I have to use two OAuth/OpenIdConnect bearer token with PKCE?

We have some REST APIs exposed to public applications. Those applications are registered with an (application protocol scheme) redirect URL and we provide to the developer a client secret and client ...
4
votes
0answers
55 views

Architecting a solution with native login and 3rd party login via OAuth/OpenID Connect using dotnet core

I am building an API driven application that will have a native login with username and password, and will also need to grant 3rd party access via OAuth/OpenID Connect in the near future. A pattern I ...
2
votes
1answer
86 views

Is re-prompting a user for credentials an effective measure to prove a user's identify

I'm upgrading the authentication of an application from self hosted forms authentication to OpenID Connect through Azure Active Directory B2C (AAD B2C) and have found a few pages which re-prompt the ...
0
votes
1answer
79 views

SSO authentication & authorization architecture/implemenation

We got a bunch of different services (SPAs + API GW, legacy JavaEE apps, etc.). Each of those is usually ran in multiple instances (customer specific instances). The plan is to federate them under a ...
2
votes
1answer
250 views

Did I get it right? OAuth2, OpenID and OpenID Connect

After a lot of research about authentication and authorization, I reached the following but not sure if what I reached is the correct thing so please help me out: Authentication is who you are. ...
0
votes
1answer
58 views

Is it safe to just forget OAuth tokens, and not invalidate them in a mobile app?

I have a mobile application that a user signs into using OpenId Connect and OAuth 2.0. Currently when the user logs out, I open up a webpage to the end_session_endpoint (http://docs.identityserver.io/...
1
vote
2answers
53 views

Is it dangerous not to verify the signature of an id token issued by an external authorization server?

I need to retrieve some values from an id token issued by an external authorization server inside a private network. I asked for the certificate used to sign the jwt in order to verify it but I've ...
1
vote
1answer
457 views

How can I securely disable CSRF validation for native clients when browser clients access the same API?

I have an API endpoint that is accessible by both native (console, mobile apps) and Javascript based clients. How do I ensure that the CSRF AntiForgeryToken is only invoked during Javascript calls? ...
1
vote
1answer
78 views

Is it a good idea to notify a user that they signed up with a social-login account?

Say my website provides three main ways to signup/signin: Google, Facebook and typical username/password. Is it a good idea to flash "Please login using your Google account" if a user tries to login ...
1
vote
0answers
430 views

OpenID connect authentication with cookie authentication middleware [Asp.Net MVC ]

In my ASP.NET MVC based application I am using 'OpenID connect authentication' middleware with 'cookie authentication middleware' (session/transient cookie). While accessing the application I ...
1
vote
1answer
182 views

JWT access tokens: Too much information?

I've recently encountered the practice of systems using JWTs as Access Tokens. I have a concern and I'm not sure if it's unfounded: I associate JWTs with the OpenID Connect protocol, where there are ...
1
vote
1answer
44 views

What are the pieces of information delivered in a user profile at the end of a OpenID Connect flow?

From what I understand about using OpenID Connect (over OAuth2), is that we end up with some JSON containing information about the user. That information is transported as a JSON Web Token. ➥ What ...
2
votes
1answer
60 views

What is the proper flow for authentication?

I'm tasked with migrating a group of .Net WebForms applications from a current custom username/password login scheme to an oauth2/openid connect based authentication and authorization. This specific ...
1
vote
1answer
875 views

MS Active Directory vs OpenId Connect?

I have to setup a user authentication system which shall be used for more than one application. Coming from Windows background, Microsoft Active Directory came to mind naturally. But I have heard ...
2
votes
1answer
89 views

How to properly deal with different user-facing login mechanisms?

I'm wondering if it's possible to deal with a login mechanism that is dependent on the user identifier. For example, the user can have access using OpenId, OAuth or token. But how can we "help" the ...
1
vote
1answer
47 views

How does the authorization work after authentication using OpenID Connect

Suppose that a client gets an ID token and access token from the auth server after successful authentication. The client now sends a request to the application server (request contains access token ...
1
vote
1answer
128 views

Is Browser based flows required for most IdP based Authentication standards?

I'm going to apologize in advance for the rambling nature of this question, I've read a lot about SAML and OIDC and other standards, just trying to understand why browsers seem to be so essential for ...