The Last Authentication System You Will Ever Write

The Last Authentication
System You Will Ever Write

Jason Austin - @jason_austin - jfaustin@gmail.com

Thursday, May 26, 2011

A Quick Rundown

• Authentication Basics
• Pros/Cons of ofﬂoading
• Authentication Mechanisms
• Authentication Providers
• Implementation


Authentication Basics
Authentication
!=
Authorization

ﬂickr - @digiart2001

Who you are
vs.
what rights you have


Setting Up An Auth
System
• Signup
• Conﬁrmation
• Authenticate (Username / Password)
• Password Retrieval / Reset
• Password Change


Security Requirements

• Secure Transactions
• Salting/Hashing Passwords
• Storing Passwords
• Password Strength Requirements
• Policies surrounding username selections


User Impact

• Signup process
• Name
• Password (And Conﬁrm)
• Email Address
• Yet another set of credentials


ﬂickr - @sbisson

Ofﬂoading Authentication

What is Ofﬂoading?
• Authentication via third trusted party

• User creates an account there (or likely already
has one)

• They manage passwords and usernames

• Host application passes user to authentication
provider

• No passwords pass over your wire


Why Ofﬂoad?

• Dirty work is done for you
• No Passwords. Ever. None.
• No Username Selections
• Implementation is quick and easy
• Signup is fast


Effectiveness

• Quick Conversion
• Personal Information
• Demographic Information


Downsides

• Indentured to a provider
• Require a third party for a critical aspect of
your application


Who To Use?


Finding a Provider

• Reliability
• Support
• Trust from users
• Usage
• Longevity


Make A Choice

• Pick the right service for your audience
• Choose multiple services


Getting Started

First Step

• Getting to know the technologies
• OpenID
• OAuth


OpenID

• One login, multiple sites
• Decentralized
• URI-based. EX: jfaustin.myopenid.com
• Service provided by anyone


OpenID Workﬂow


OpenID
• Hasn’t really caught on
• Thought of as “geek speak”
• Service providers include
• Google
• Yahoo
• Many more...

OAuth

• Open standard for access delegation
• With authentication, provides ability for
SSO
• Valet key to the internet


OAuth Players
• Service Provider (Server)- Has the
information you want
• Consumer (Client) - Wants the information
from the Service Provider
• User (Resource Owner) - Can grant access
to the Consumer to acquire information
about your account from the Service
Provider


OAuth

• Technology behind authentication from
• Facebook
• Yahoo!
• Twitter


Sign in with Twitter

Get Started

• Register your app with Twitter
• https://dev.twitter.com/apps/new
• Add some UI to your app
• Choose an OAuth lib to help


OAuth Libraries
• oauth-php
http://code.google.com/p/oauth-php/

• Zend_Oauth
http://framework.zend.com/manual/en/
zend.oauth.introduction.html

• OAuth PECL package
http://pecl.php.net/package/oauth

• CakePHP OAuth Package
http://code.42dh.com/oauth/


Files Needed

index.php auth.php callback.php

* Need a OAuth library. We’re going to use ZF


Logging In
<?php
// index.php

if (isset($_SESSION['auth'])) {
echo "Logged in";
echo "<br><br><pre>";
print_r($_SESSION['auth']);
echo "</pre>";
echo "<a href='logout.php'>Logout</a>";
} else {
echo "Not logged in";
echo "<br><br>";
echo "<a href='auth.php'>Sign in to twitter</a>";
}


Authentication
<?php
// auth.php

if (isset($_SESSION['auth'])) {
echo "already logged in";
die();
}

$options = array(
'consumerKey' => 'asdfgawe23aewvserg43tg',
'consumerSecret' => 'asdf34visnerfg9j0ae49gj09srjg9ae',
'callbackUrl' => 'http://pintlabs.com/demo/callback.php',
'siteUrl' => 'http://twitter.com/oauth'
);

require_once 'Zend/Oauth/Consumer.php';
$consumer = new Zend_Oauth_Consumer($options);

$token = $consumer->getRequestToken();

$_SESSION['requestToken'] = serialize($token);

$consumer->redirect();


<?php
Receive the Callback
// callback.php

if (!isset($_GET['oauth_token'])) {
die("oauth_token not set");
}

$response = array(
'oauth_token' => $_GET['oauth_token'],
'oauth_verifier' => $_GET['oauth_verifier'],
);

// same options as auth.php
$consumer = new Zend_Oauth_Consumer($options);

$requestToken = unserialize($_SESSION['requestToken']);

$accessToken = $consumer->getAccessToken($response, $requestToken);

unset($_SESSION['requestToken']);

parse_str($accessToken->getResponse()->getBody(), $params);

$_SESSION['auth'] = $params;


Best Practices

A Few Things To
Remember...
• What if the external key changes?
• Changed OpenID URL
• Changed Twitter ID
• Multiple accounts from the same user


Account Management

• Have an internal application account id
• Link external accounts to internal id
• Allow management of external
authentication sources by the user


Have A Backup Plan

• Downtime
• Removal of service
• Change in service


Questions?
Jason Austin - @jason_austin - jfaustin@gmail.com

http://joind.in/3431

Code Available at
http://github.com/jfaustin/tek11-twitter-auth


The Last Authentication System You Will Ever Write

Recommandé

Recommandé

Contenu connexe

Dernier

Dernier (20)

En vedette

En vedette (20)

The Last Authentication System You Will Ever Write