OAuth, OpenID Connect and .NET – the Good Parts
OAuth has been around for more than 10 years now, and has become the standard protocol for token-based security. Like every popular technology that has been growing with its requirements, there are some things which work really well, and some that did not quite stand the test of time.
2023 is an excellent year to either start learning OAuth & OpenID Connect from scratch or give them a refresher. With the upcoming OAuth 2.1 protocol revision, the protocol has been streamlined and simplified and the specification has been updated to meet modern application and security requirements. At the same time ASP.NET and .NET in general has excellent support for all the moving parts needed to implement an OAuth-based security system.
This full day workshop teaches you all the OAuth you need utilizing the most common and practical techniques and libraries in the .NET ecosystem. Besides looking at built-in features of (ASP).NET, we will use popular frameworks like IdentityModel and IdentityServer, and we will learn how to use them to secure native/desktop and web applications as well as SPAs, Blazor WASM applications, APIs and daemons.
Agenda
1 Intro
- OAuth history and motivation
- OAuth terminology and architecture
- OAuth 2.1
- Typical protocol flows and application scenarios
2 Machine to Machine Communication
- Client Credentials Flow
- Access tokens
- Token Management
- Simplifying protocol interactions with IdentityModel
- Automatic token management
- Writing daemons using .NET Workers
3 Securing APIs
- JWT Bearer authentication handler for ASP.NET
- Authorization policies
4 Interactive Applications
- Authorization Code Flow
- Proof Key for Code Exchange (PKCE)
- The need for OpenID Connect
- Session management
- Refresh tokens
- Automatic token management with IdentityModel.AspNetCore
- Writing web applications using ASP.NET
5 Bringing it all together
- Integrating various applications into one coherent architecture
- Identity Providers & token services
- Federation gateways
- Daemons
- Web applications
- Native/desktop applications (e.g. Windows desktop or mobile apps)
- SPAs / Blazor applications
Joe DeCock is a software consultant and trainer from the Twin Cities. He has more than a decade of experience working on software in a variety of industries, including Healthcare, Finance, Television, Legal, and Publishing. He specializes in Identity, .NET and IdentityServer.
Outside of work, Joe enjoys cooking, board games, and spending time with his family.