This document discusses OAuth2 profiles like OpenID Connect and UMA and why they should be adopted for IoT. OpenID Connect provides identity while UMA provides access control. Both standards have been in development for 10 years based on prior experience. They are a perfect fit for IoT use cases as they standardize interfaces without assuming cloud, are proven usable by developers, are small, scale well, and have industry consensus with Google and Microsoft supporting OpenID Connect. UMA 1.0 will be announced in April 2015.

1. OAuth2 profiles:
OpenID Connect / UMA
Why adopt for IOT?

2. OAuth2
Identity
Standards
poised for
significant
success...
WAM
* WAM = Web Access
Management (SiteMinder, Oracle
Access Manager, etc.)

3. OpenID
Connect
http://openid.net/connect

4. Connect Discovery
GET request to https://<host>/.well-known/openid-configuration
See specification:
http://openid.net/specs/openid-connect-registration-1_0.html
See sample Response:
http://seed.gluu.org/.well-known/openid-configuration

5. Connect Dynamic Client Registration
See specification:
http://openid.net/specs/openid-connect-registration-1_0.html
See sample Dynamic Client Registration html form:
http://seed.gluu.org/oxauth-rp

6. Connect Authentication, User Claims
and Client Claims
See specification:
http://openid.net/specs/openid-connect-core-1_0.html
Overview of four flows:
http://www.gluu.co/connect-flows

7. Authentication + Claims != Access Control

8. Policy Decision Point UMA Authorization Server
Policy Enforcement Point UMA Resource Server

9. UMA
Working Group Home Page:
http://www.gluu.co/uma-wg
By presenting an authorized
RPT token, the Resource
Server can verify that access
has been granted.
The PAT and AAT are just for
secure communication.

10. UMA does not...
● Define any policy expression language
● Say who makes the decision
(although it defines capabilities to enable
people to centrally manage policies)

12. Why adopt these two OAuth2 profiles ???
1. 10 years of development based on 10 years of experience.
Both standards started around 2010. From 2001-2010 we gained critical
feedback from developers on what kinds of APIs are needed for security.
2. Perfect fit for IOT--in fact designed to solve almost the same exact use cases.
3. Does not assume cloud--just standardizes interfaces. Local authorizations
servers should use the same protocol as cloud servers.
4. Proven usability by developers--OAuth2 is now industry standard and many
libraries exist. You can start simple.
5. Small on the wire: json messaging uses less bandwidth and computing power
6. Scales for high-end security requirements. NIST LOA 3 and LOA 4 deployments
are possible.
7. Industry consensus exists for OpenID Connect: Google and Microsoft already
supporting it.
8. UMA 1.0 standard to be announced at RSA Security in April, 2015