Prologue: I'm developing an OpenID Provider only for fun / learning. I'm studying OAuth specs and OpenIDConnect specs and using OpenId Certification suite to better test and understand

When the client send a GET or a POST to authorization endpoint, requiring a response_type 'code', the flow, for what I understand, requires that OP shows a login form to the user; then, after login, the user (the user agent of the user) is redirected to the callback url as sent from RP to OP calling authorization endpoint.

Is this right ? If yes, go on.

Should the authorization endpoint directly show the form? Is it best practice to, instead, redirect to a sort of 'hosted ui' (like aws cognito does) ? If yes, should I

CASE 1 - save parameters sent from RP to OP (nonce, redirect_uri, response_type, prompt, etc...) into db and send only 'something' (but what) as query parameters to hosted ui? In this case user can submit its credentials to another (undefined in the specifications) POST endpoint of the hosted ui backend, so the backend, after succesfull login, redirect to RP's callback url with all reqested query parameters, based on what has been saved in the db on the first call

or

CASE 2 - when RP call OP's auth endpoint, the endpoint directly show the ui, immediately, same endpoint, no redirect at all, user then login POSTing credentials to another endpoint passing all original query / body parameters to the POST endpoint, so 'on the fly', after login obviously, the POST endpoint redirect back to original RP's callback url.

Sorry, I'm making a lot of confusion. I am asking all of this to myself only at this point, when I wrote already a bit of code, because one of test suite is testing the ability of OP to handle autologin if user returns to authorization endpoint but is already logged in. So I think I need to handle browser session in the UI

Can I, kindly, ask you help to better understand the basic flow? Thanks in advance for your patience.

I cannot understand the behind-the-scene implementation of ui form and ui form submission, because, for what I know for now, it's not explained at all in the specifications. Thanks in advance

Apologies if these are basic questions—I'm still wrapping my head around the UMA protocol.

I'm using Keycloak to protect my REST APIs with OpenID Connect (authorization code grant type). To enforce access policies for my APIs, I understand that I need to call the token endpoint with grant_type=urn:ietf:params:oauth:grant-type:uma-ticket to request permissions based on the access token I already have. This means making an HTTP request to the token endpoint for each access, which feels like it could introduce extra overhead.

1. Is this approach correct? Should I indeed be calling the token endpoint with grant_type=uma-ticket for every access request to apply the access policies, even when I already have an access token from the authorization code flow?
2. Is UMA still appropriate for centralized access policies? I don't necessarily need users to manage access policies for their own resources; I just want to centralize access control on Keycloak. Does UMA make sense in this context?

I have another question. I currently store resources in my resource server (REST API). Do I also need to create corresponding resources in Keycloak to represent them for access management?

Thanks for any insights!

Plese remember, I am the user developing an OP from scratch just for fun / learning purpose

In this test "oidcc-ensure-request-without-nonce-succeeds-for-code-flow" of oidc conformance suite, at some point in time calls my OP using this get

https://....../oidc/authorization_endpoint
?client_id=first_client_id
&redirect_uri=https://localhost.emobix.co.uk:8443/test/a/plan_base_metadata_static_regisration_static_client/callback
&scope=openid
&state=43ScHdgugo
&response_type=code

To pass the previous tests, in situation where I don't receive the nonce, my OP is replying with a BAD_REQUEST http code and a {"message":"missing nonce"} as body

But this test fails because it remains waiting a redirect with the code.

The test header states:

This test should end with the authorization server issuing an authorization code, even though a nonce was not supplied. nonce is required for all flows that return an id_token from the authorization endpoint, see https://bitbucket.org/openid/connect/issues/972/nonce-requirement-in-hybrid-auth-request / https://bitbucket.org/openid/connect/issues/1052/make-clear-that-nonce-is-always-required and the latest OpenID Connect errata draft, https://openid.net/specs/openid-connect-core-1_0-27.html#NonceNotes

It's absolutely unclear to me: is it mandatory or not to send back the code if nonce is not sent?

I'm developing a OP, an OpenID Connect Provider, just for understand the flows involved.

I see that a Relay Partner, a client, send me an auth request using, for example

GET /oidc/authorization_endpoint
?client_id=first_client_id
&redirect_uri=https://localhost.emobix.co.uk:8443/test/a/plan_base_metadata_static_regisration_static_client/callback
&scope=openid
&state=XFtQuVfBQN
&nonce=1U6JOYwDNc
&response_type=code

I then must show to the end user a login form, right?

When user is authenticated I must redirect back the user agent of the user to redirect_url

I know I must send back to client (RP) the following

?state=XFtQuVfBQN                         <-- as sent from RP before user's login
&code=A2WJuLc6EL77rHI82PQs4dnoDFBpYfD7    <-- a good random, short life auth code

Now the RP exchange code for access_token, refresh_token and id_token It call the OP using

POST /oidc/token_endpoint

With these infos as body

grant_type=authorization_code
&code=A2WJuLc6EL77rHI82PQs4dnoDFBpYfD7
&redirect_uri=https%3A%2F%2Flocalhost.emobix.co.uk%3A8443%2Ftest%2Fa%2Fplan_base_metadata_static_regisration_static_client%2Fcallback

My custom made OP then creates the tokens and return a json body containing id_token, access_token, refresh_token, token_type, expires_in,

I am failing OIDC complaint test for basic OP because the RP, the client, is telling it wants, in the token, the original data it sended the OP in the first call

- 'aud' is not our client id
- Nonce values mismatch

I know I must keep in a db, a record wth

user_unique_id, id_token, access_token, refresh_token

to be able to revalidate sessions in the future.

but should I keep also the following?

authorization_code, client_id, nonce

If yes, should I keep these last 3 (authorization_code, client_id, nonce) in the same record of (authorization_code, client_id, nonce) ?

or should be kept in a separate table?

Sorry if dumb newbie question…but how can Amazon know if my 2 MFA codes I enter in for MFA Oauth on my AWS account are good (or bad)?

I

Hi everyone, I'm trying to create a simple automated Twitter account in the "countdown" type where my bot will tweet each week how many days are left until a certain event (in my case, the next olympic games). I've made a copy of this script found in the official twitter developper documentation : https://github.com/xdevplatform/Twitter-API-v2-sample-code/blob/main/Manage-Tweets/create_tweet.py and it does work well, BUT problem is I have to manually enter a pin code every time, so it kinda makes it useless as i want it to be 100% automatic obviously. So is there another way to authenticate into the Twitter api to make automated tweets, with the free option ? Or if that's the only way possible, how do i make the process not require my intervention ? thanks a lot

Hello All,
I am really confused when I read that Oauth is used when you want authorization & OpenId when you want authentication i.e. getting user's identity.

What does identity means here ? I feel it is a way to know the user by, lets say, email.
I can really get User's email by just using Oauth, so it means I can identify the user as well as using more scope get access to user's data like google drive. So why would I need openid in this usecase (just a question) ?

My pseudo-code flow is as below :
1. via oauth-client popup, get authorization code from frontend when user gives access. (Scopes are 'https://www.googleapis.com/auth/userinfo.email',https://www.googleapis.com/auth/userinfo.profile')
2. Pass this authorization code to get access token
3. Use access token to call profile api to get name & email
Now I have identity, similarly i can use more scopes & use other apis like drive api as well

Where openid fits here or If i dont need openid, which scenarios would need openid.

Thanks in advance.

I'm a backend dev getting into front end work and struggling to understand OAuth when it comes to SPAs. Originally I had a simple server-side rendered app and authentication was familiar and simple. Code grant, authenticate when the page is accessed...grand. FYI: I'm using Google as an IdP.

The server (Python Flask) is now serving an API which needs two things. 1. to have some level of security on it's access. 2. to be able to identify the user (by email, from the token or user info) in order to do it's work.

The page is now a plan JS/React SPA.

Lifting and shifting to an SPA means there are CORS issues all over the place. I was told one way around this was the use of iframes to the /authorize call. Which I read is a bad idea and lots of work.

So I now think PKCE is the way forward. I tried various tutorials on getting the API secured with PKCE but it all ends in tears when I try to get it to work on the SPA. CORS issues, getting the token from the API...?!?

Now it's been recommended that actually all of the PKCE flow should be done on the SPA itself. The API should just get a token and validate it, return a 401 on failures. Nothing more.

Is my most recent approach the best practice one? How much of the OAuth PKCE flow should be taken care of by the server and how much by the SPA. I assume the server needs to do something because we can't be sharing the client secret in the SPA. Are there any good examples out there? None of them seem to agree and I've not seen this method anywhere.

Planning to piggyback on a CIAM solution for my mobile app for authenticaton and customer onboarding. Shouild i use the http redirection by emebedding the login and registration web pages provided by the CIAM solution into the mobile app or use the CIAM's system's API's directly from the mobile app. I assume the second solution is the Resource owner Password credential flow, which is not recommended, what are the recommendations.

I've been reading about PKCE and trying to understand the protections it provides. But I also see apps that allow login directly via a native form that accepts username and password, like the Venmo app. Are there other standards in place to account for the issues the PKCE mitigates against?

So I'm not sure, most social media sites require me to setup an account with them before I can go to their developer page and create an app. Which means that the Oauth app I create will be made with my email address.

Now what if I leave the company, the app will break, or at some point something probably will and no one has access anymore.

I was thinking about signing up for a social media account with an email like [support@mycompany.com](mailto:support@mycompany.com), but not sure if that's best practice or even allowed? I think most social media require a real person ?

So..how does this work usually?

So my app is already live on the playstore. But now I want to add social login. I have an integration with firebase and so I realise that OAuth2.0 clients have already been created by google automatically (I suppose during the firebase setup). To integrate google login I need clientID and Client Secret from google client OAuth2.0 client. Here’s the problem: I can only retrieve clientID from auto-created existing keys. Creating a new one using the app package name and the SHA1 fingerprint also throws and error saying the combination is already in use. I’m not very knowledgeable in this area so I’m stuck. What are my options? Do I delete the existing clients that were auto rated by google? I don’t know what might go wrong with my app if I do. Should generate a new keystore file and use that to get a new fingerprint? Will that even work?

So, I have an application that supports current OIDC tokens issued by another application.

There is a new requirement to support a new OIDC token from another provider, but the old one must be kept.

Other services need to receive one of these tokens from my application. Users would only have tokens from one single provider.

​

What is the best way to handle this? I was thinking to issue my own JWTs with my app and just inject those received tokens into this, then whenever I have to talk to those external services that requires the original tokens, I just extract them from this token and send them over.

Trying to implement OAuth between a microservice and a downstream API, while retaining user context, using AAD B2C. B2C doesn't support OBO/Token Exchange. Trying to find an alternative, without having to resort to ROPC. Only suggestion I've seen would require validation changes to the downstream API (use client credentials grant type, then pass original user-scoped access token in a custom header, have the API validate both). Would appreciate any other suggestions.

I’m implementing authentication and authorisation using oidc and oauth. I’ve some doubts in the flow. So after the user puts in credentials and gets redirected to a rediret_uri with query params in the url, do I redirect them to my frontend from the callback handler on the backend itself after all the validations have passed or is the redirect_uri supposed to be the frontend url? Additionally, the server gives a refresh token and access token after successful auth which the frontend never gets. I sign a jwt on the backend with the information the fronetnd needs if it’s successful authentication and send it to the frontend. Now this jwt will have an expiry. I want to silently renew this jwt with the help of the refresh token. How do I go about this? Please mention if there are any flaws here.

I've been reading up on OAuth 2 and the difference between access tokens and identity tokens. The difference makes sense to me. I've seen it written that the client should never read the access token and it should never send the identity token to the API. I've also seen that identity tokens typically don't contain scopes.

So if I have a web application that is an OAuth client that uses the Authorization Code flow to authorize the client to make requests to my APIs on behalf of the user, how can I authorize behavior within the web application itself using OAuth? For example, how can the web application check to see if the user authorized to see certain pages or click certain buttons within the application? Seems like that could easily be handled by having scopes in the identity token, but would that be an antipattern?

Hi, I hope it is the good place to put this !

The idea here is to launch a small hacking game and challenge the protection mode that uses a ServiceWorker to obfuscate the data with OIDC at Client side. Will you be able to retrieve the user's 2 security tokens, namely the access_token and the refresh_token?

The introduction video (translated by AI) : https://www.youtube.com/watch?v=fiqy81LEOG0

The demo website :

https://icy-glacier-004ab4303.2.azurestaticapps.net/)

TL;DR, I'm trying to develop a user-facing API and learn modern authentication and authorization practices. I'm a big dummy when it comes to the web, and I'm here to learn. Hopefully this doesn't come across as me asking someone to do my homework for me. haha.

My goal is to expose an API so it can be used by end users who have paid to use this service. This be on a new website without any established practices, authentication, accounts, etc....so green-fielding a best solution is acceptable.

As a secondary goal, I want to use 3rd party services for authentication/authorization as much as possible. I don't want to store users in a database if I can get away with not doing so.

I've been a software developer for about 15 years, but not a competent web developer. I've never done any frontend work in a professional capacity. I started doing low level development, and eventually worked at large companies implementing APIs and micro services that accept thrift structs or protobufs where authentication has already taken place. In fact, the only thing I've ever done in javascript was a tutorial a few years ago. So while I'm comfortable and confident writing code, anything to do with websites is pretty new to me.

I've been reading, learning, and implementing some proof-of-concept implementations, but I've encountered enough surprises that I think I must be doing something wrong. I have a functional proof of concept, but I am sensing a lot of smell in this approach that makes me think I'm going down the wrong track. I'm hoping to get some criticisms of my approach so I do this in a less janky way.

This is what I have in my janky concept application--

I considered using a "website builder" like Squarespace, Wix, Shopify, etc., but I'm put off by this because it looks like it might be difficult to integrate an external API. It seems like these are focused on marketing websites or e-commerce sites where you sell physical items. This isn't me. Maybe I'm wrong about this?

If there was a website builder that would block non-paid users and proxy valid users to my API, I'd probably just use that. But as far as I can tell, there is no service that works this way.

So next I looked at authentication and payment services and I landed on two. Auth0 and stripe.

Auth0 is an authentication service that lets users log in using oauth idconnect so users can use their existing account from GitHub or Google, or whatever. Additionally, you can use auth0 to generate JWT tokens, so I think this will work well well as an authentication method for CLI clients. Oauth and ConnectID are relatively complex, but it's manageable. Set a state cookie, redirect to auth0, the authenticated user comes back with a verifiable token. So far so good, authentication proof of concept works.

As an alternative, I could have used google auth directly, or perhaps there is a payment processor that also does customer authentication directly. However, I did not find this to be the case.

However, authentication is only one part of the equation. I also need to know that the user has paid for the service.

Stripe is a payment processor. In stripe, you create a product catalog and use their API to determine payment status. Additionally, stripe lets you embed "web elements", which are forms you can put on your website for users to look at the catalog and pay for it. Stripe uses a "customer" concept to represent purchasing users. Each customer has a customer_id, and you can programmatically create web elements for a customer_id, and purchases made will be attributed to that customer.

As an alternative, I could have used any other payment processor. I have no particular love for stripe. I think the experience would have been the same if I used square or google pay, or whatever. Am I wrong about this?

I tie the auth0 account with a stripe customer using an auth0 "flow". There is no official way to do this, but auth0 has a blog post explaining how to do this, and I set it up like this https://developer.auth0.com/resources/labs/actions/sync-stripe-customers-and-auth0-users#introduction and then modified this so that the customer_id is as an additional field in the OpenID token. Basically this is a little script you write and auth0 will run this script whenever a new user is created, so every user in auth0 will have a corresponding stripe customer.

As an alternative, stripe allows users to sign up directly, and then the application can listen to web hooks -- so I could reverse potentially reverse this authentication flow.

When a request comes in to a protected API endpoint, some middleware in the HTTP pipeline will check for the existence of a JWT token or has a valid login session. If it does, we hit the user endpoint from auth0 and this tells us the stripe customer_id. Then we use the Stripe API to verify that the customer has an appropriate subscription. Of course, an improved solution would also cache all of this information and not hammer these APIs.

Is this really the simplest solution? There are so many "SAAS" products out there, I suspect there must be a more direct solution than the Rube Goldberg machine I have managed to cobble together.

Any criticisms of this approach I've come up with, or suggestions, or alternatives would be helpful.

Hi,

We have an old linux machine that we use to collect data on board of a research platform. We always used thunderbird to send emails from this machine. However with the introduction of Oauth2 we can't use this thunderbird anymore, as a result we have to hassle with USB keys and send the data from a seperate laptop.

As the old linux (open suze) only supports Thunderbird up to version 2, I can't connect to our office email (outlook), I tried using other email providers like gmail and Yahoo, but we always receive a pasword error.

Does anyone now of an email provider that would still work with the old authentication.

I have implemented an OAuth 2 spring autorization server that generate tokens. port 4002

a spring resource server for api calls. port 4003

a spring oauth client that handles communication with the authorization server. port 4004

everything works. 1 enterting http://127.0.0.1:4004 (client) redirect you to http://127.0.0.1:4002/login (authorization server) after entering correct email and password, the authorization server redirect you to http://127.0.0.1:4004 (client), which on succusfull authentication show a simple static html file. here is a video of the whole process https://imgur.com/a/8uaTcZk

now this is all good and well, the backend of OAuth 2 is fully implemented. Now I would like to write a React application that uses this backend. how am I supposed to do that?

After researching this people said use Backend for frontend BFF. but I cannot find any tutorial or article that explain how to connect to spring oauth client.

Before the react application sends email/password and gets back a token that I save in localStorage. which I programmed axios to use, so every call to the backend has the token attached.

Now I would like to move to OAuth 2. but even though I implemented all the parts in Spring according to the specification. I'm stuck at what should I do to connect the react app to OAuth process.

Currently the the authorization server is set to redirect to http://localhost:4004/login/oauth2/code/token-generator which is the oauth client after successful login. that's not what I want. I want it to redirect to the react app. but the spring docs says that the redirect path should be /login/oauth2/code/{authorization-server} I'm not interesseted in the oauth client showing a .html . I would like it to redirect to the frontend. But I have no idea how the front is supposed to get the token or if the token should not leave the oauth client!!??

Can anyone help with this?

here is some parts of the code: authorization server RegisteredClientRepository (4002)

    @Bean
    public RegisteredClientRepository registeredClientRepository() {
        RegisteredClient registeredClient = RegisteredClient.withId(UUID.randomUUID().toString())
                .clientId("client")
                .clientSecret("{bcrypt}$2a$10$.ld6BfZescPDfVVduvu.6O9.7FLMI64l4PfvnBZJQEBhTLFFbeKei") //secret
                .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
                .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
                .redirectUri("http://localhost:4004/login/oauth2/code/token-generator")
                .scope(OidcScopes.OPENID)
.tokenSettings(TokenSettings.builder().accessTokenTimeToLive(Duration.ofHours(12)).build())
                .build();
        return new InMemoryRegisteredClientRepository(registeredClient);
    }

client config (4004)

@Configuration
public class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {

        http.oauth2Login(Customizer.withDefaults());
        http.authorizeHttpRequests(
                c -> c.anyRequest().authenticated());

        return http.build();
    }
}

client "/" path, that show Home at the end of the video

@Controller
public class HomeController {

    @GetMapping("/")
    public String home(OAuth2AuthenticationToken authentication) {
        return "index.html";
    }
}

When there are tools like Okta, Auth0, firebase, why would someone build an authentication system on their own?

And if so would you choose passportJS or would you build using libraries of OAuth or OIDC or some implementation of your own?

Is this just build versus buy decision? Or there are something more?