Authenticating with OAuth2?

[Wessel, Keith]

Thanks, Henri. All excellent questions/points. I’ve passed this along to the vendor.

Keith


From: users <users-bounces at shibboleth.net> On Behalf Of Henri Mikkonen via users
Sent: Tuesday, June 4, 2024 4:02 AM
To: Shib Users <users at shibboleth.net>
Cc: Henri Mikkonen <henri.mikkonen at csc.fi>
Subject: Re: Authenticating with OAuth2?

Hi Keith,

Joining the discussion a bit late. One good question for the OAuth2 client would be: how they would like to use it for authentication? In short: pure OAuth2 is about issuing and usage of access token, possibly together with a refresh token. The access token is supposed to be used against a protected resource. What would be the protected resource? OIDC standardises the user info endpoint to be the protected resource from which to obtain the user attributes via access token. In addition to that, OIDC also specifies the id_token that is used for the authentication metadata, and optionally for the user attributes too.

This is a good link to be given to anyone who claims that OAuth2 is an authentication protocol: https://oauth.net/articles/authentication/<https://urldefense.com/v3/__https:/oauth.net/articles/authentication/__;!!DZ3fjg!4zttsYjK5Xi_IsboftaY8K_mv6pePf-pkb2YOaLDxcjG1TPCR8u_DiImVaXBHb_XgcxyGBS5kPFt6PSla6R6$> . The main message of the article is that it’s not.

Perhaps the client expected you to provide JWT access tokens with some user attributes, but let them read that article.

BR,
Henri.


On 31. May 2024, at 19.53, Wessel, Keith via users <users at shibboleth.net<mailto:users at shibboleth.net>> wrote:

All very valid points. I'm going to pass these along to him. I wasn't actually comfortable with using OAuth2 for this use case, anyway, but I couldn't elaborate why. You put your finger on it.

Thank you,
Keith


-----Original Message-----
From: Cantor, Scott <cantor.2 at osu.edu<mailto:cantor.2 at osu.edu>>
Sent: Friday, May 31, 2024 11:30 AM
To: Shib Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Cc: Wessel, Keith <kwessel at illinois.edu<mailto:kwessel at illinois.edu>>
Subject: Re: Authenticating with OAuth2?


Right. But since the OAuth2 spec says scope is optional for
OAuth2 authorization requests, I can't really tell him that the
library he's using violates the spec.

Sorry, but you can. This comes up in SAML a lot. It's important.

Features may be optional to *use*, but they're mandatory to implement.

We had a bug, and so does that library.

In general, scope is really required for OAuth to work safely on its own because scope was originally the substitute for "audience", it limits a token's usage.

One other point I had intended to make: what he's asking for isn't safe anyway. If you try and abuse OAuth to "just" do SSO, you'll generally have holes. OpenID is at a basic level just intended to codify usage to avoid the worst of them, so without it, you tend to end up with problems.

-- Scott


--
For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw<https://urldefense.com/v3/__https:/shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!DZ3fjg!4zttsYjK5Xi_IsboftaY8K_mv6pePf-pkb2YOaLDxcjG1TPCR8u_DiImVaXBHb_XgcxyGBS5kPFt6HJHaAXk$>
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240610/a1bbb62a/attachment.htm>