Technologies that are being used together to secure RESTful APIs: SAML (and eventually OpenID Connect), OAuth, SCIM, and the JSON Identity Protocol Suite (esp. JWT). Discussion how these technologies can be combined to provide enterprise grade security for APIs and put this need into the broader context.

1. The “Neo-security Stack”
Securing APIs using the new stack of RESTful technologies
By Travis Spencer, CEO
@travisspencer, @2botech
Copyright © 2013 Twobo Technologies AB. All rights reserved

2. Agenda
 The security challenge in context
 Neo-security stack
 OAuth Basics
 Overview of other layers
Copyright © 2013 Twobo Technologies AB. All rights reserved

3. Crucial Security Concerns
Copyright © 2013 Twobo Technologies AB. All rights reserved
Enterprise
Security
API
Security
Mobile
Security

4. Identity is Central
Copyright © 2013 Twobo Technologies AB. All rights reserved
MDM MAM
A
u
t
h
Z
Mobile
Security
API
Security
Enterprise
Security
Identity
Venn diagram by Gunnar Peterson

5. SAML /
OpenID
Connect
SCIM
JSON
Identity
Suite
OAuth
The Neo-security Stack
Copyright © 2013 Twobo Technologies AB. All rights reserved
Federation Provisioning
Identity Authorization

6. SAML
 SAML: proven
technology for
identity federation
and Web SSO
 Profiles, bindings,
protocols, assertions
& metadata
 V. 2.1 in
the works
Copyright © 2013 Twobo Technologies AB. All rights reserved
Service
Provider (SP)
Identity Provider (IdP)

7. OpenID Connect
 New federation protocol that builds on OAuth 2
 Adds identity inputs/outputs to OAuth messages
 Related to prior OpenID versions in name only
 Compact messages for mobile scenerios
 RP / client can determine info about end user
 Tokens are JWTs
 UserInfo endpoint to get user data
Copyright © 2013 Twobo Technologies AB. All rights reserved
Grandpa SAML
& junior

8. Overview of SCIM
 Defines RESTful API to manage users & groups
 Specifies core user & group schemas
 Supports bulk updates for ingest
 Binding for SAML and eventually OpenID Connect
Copyright © 2013 Twobo Technologies AB. All rights reserved

9. OAuth
 OAuth 2 is the new protocol of
protocols
 Composed in useful ways
 Like WS-Trust of old
 Addresses old requirements and
solves new ones
 Delegated access
 No password sharing
 Revocation of access
Copyright © 2013 Twobo Technologies AB. All rights reserved

10. OAuth Actors
 Client
 Authorization Server (AS)
 Resource Server (RS) (i.e., API)
 Resource Owner (RO)
Copyright © 2013 Twobo Technologies AB. All rights reserved
Getatoken
User a token
RS Client
AS

11. Access Tokens Refresh Tokens
Types of Tokens
Copyright © 2013 Twobo Technologies AB. All rights reserved
Like a Session
Used to secure API calls
Like a Password
Used to get new access
tokens

12. By Value By Reference
Classes of Tokens
Copyright © 2013 Twobo Technologies AB. All rights reserved
123XYZ
123XYZ
User attributes are in the
token
User attributes are
referenced by an identifier

13. Scopes
 Like permissions
 Scopes specify extent of
tokens’ usefulness
 Listed on consent UI (if shown)
 Issued tokens may have
narrower scope than requested
 No standardized scopes
Copyright © 2013 Twobo Technologies AB. All rights reserved

14. OAuth Web Server Flow
Copyright © 2013 Twobo Technologies AB. All rights reserved

15. Usage of OAuth
Copyright © 2013 Twobo Technologies AB. All rights reserved
Not for authentication
Not really for authorization
For delegation

16. JSON Identity Protocol Suite
 Suite of JSON-based identity protocols
 Tokens (JWT) ▪ Encryption (JWE)
 Keys (JWK) ▪ Signatures (JWS)
 Algorithms (JWA)
 Bearer Token spec explains how to use w/ OAuth
 Being defined in IETF
Copyright © 2013 Twobo Technologies AB. All rights reserved

17. JWT Tokens
 Pronounced like the English word “jot”
 Lightweight tokens passed in HTTP headers &
query strings
 Akin to SAML tokens
 Less expressive
 Less security options
 More compact
 Encoded w/ JSON not XML
Copyright © 2013 Twobo Technologies AB. All rights reserved

18. Authentication & Federation
 How you authenticate to AS is undefined
 Use SAML or OpenID Connect for SSO to AS
 Relay OAuth token in SAML messages
Copyright © 2013 Twobo Technologies AB. All rights reserved

19. Push Tokens & Pull Data
Copyright © 2013 Twobo Technologies AB. All rights reserved
IdP & API Provider SaaS App
Browser
Access token in
federation message
Get Data
Data

20. SCIM + OAuth
 Use OAuth to secure SCIM API calls
 Use SCIM to create accounts needed to access
APIs secured using OAuth
Copyright © 2013 Twobo Technologies AB. All rights reserved

21. SCIM + SAML/OIDC
 Carry SCIM attributes in SAML assertions
(bindings for SCIM)
 Enables JIT provisioning
 Supplements SCIM API & schema
 Provisioning accounts using SCIM API to be
updated before/after logon
Copyright © 2013 Twobo Technologies AB. All rights reserved

22. User Managed Access
 Also extends OAuth 2
 Allows users to centrally control
distribution of their identity data
 Used with Personal Data
Stores (PDS) to create “identity
data lockers”
Copyright © 2013 Twobo Technologies AB. All rights reserved

23. Questions & Thanks
@2botech
@travisspencer
www.2botech.com
travisspencer.com
Copyright © 2013 Twobo Technologies AB. All rights reserved