Enterprise OAuth 2.0 and OpenID Connect

Explore security architectures, the role of OAuth 2.0 and OpenID Connect in modern enterprises, and core concepts like identity, authentication, authorization, tokens, and LDAP/SAML infrastructures.

An identity provider authenticates users while a service provider authorizes access, using credentials and user data from the identity store, with groups or roles governing permissions.

Compare homegrown identities with LDAP and Active Directory, where the LDAP IdP authenticates and the application authorizes. Note cloud access limits and credential exposure, leading to SAML.

Explore how SAML enables single sign-on across data centers by using http redirects and the browser as a conduit, reducing manual credential entry.

Understand the SAML single sign-on flow: browser-based redirects between the application (service provider) and the SAML identity provider, exchanging claims and tokens via trusted metadata.

Discover why SAML excels at single sign-on across data centers but struggles to secure REST APIs in microservices and scheduled jobs, driving the need for new enterprise security approaches.

Explore how internet social identities differ from enterprise identity stored in a single place, and why a learning app needs proper authorization to call LinkedIn api instead of user credentials.

A real world demonstration shows a user granting Shutterfly access to Google Photos via OAuth, detailing scopes, authorization, and resource server calls to publish edited photos to Facebook.

Explore OAuth roles in a Shutterfly scenario, including resource owner, resource servers (Google Photos and Facebook), the client, and dual authorization servers.

Registering clients establishes trusted identities and redirect URIs for OAuth flows, enabling the Shutterfly app to obtain client id and secret and access the Resource Server via Google or Facebook.

Explore how the resource server uses bearer access tokens, issued by the authorization server, to validate requests via scopes and expiry, and why opaque tokens raise performance concerns.

Explore structured access tokens, including JWTs, and how they embed token data, enabling resource servers to verify signatures with a public key and extract scopes without extra calls.

Understand how OAuth scopes control access by tying access tokens to specific resource permissions, illustrated with Google Photos and Gmail APIs, and explore enterprise versus social app authorization.

Explore the OAuth endpoints that enable the authorization code flow: authorization, token, introspection, and JWKS, as used by a web backend and frontend in a Shutterfly-like scenario.

Explore oauth grant types, including authorization code with pkce and confidential versus public clients, and learn how refresh tokens and token revocation secure access.

OpenID Connect extends OAuth 2.0 by enabling user information via built-in scopes like openid, profile, and email, delivered as an id token and a user info endpoint response.

Review OAuth 2.0 grant types and map use cases to authorization code with PKCE or client credentials, avoiding implicit and password grants.

Explore practical OAuth 2.0 and OpenID Connect concepts with hands-on demonstrations of authorization code, implicit, and PKCE, using Google and Okta for client registration, HTTP messages, and token verification.

Register a Google authorization server client for a web app and obtain a client id and client secret. Configure the consent screen and redirect URIs to enable OAuth 2.0 flows.

Discover how to locate google openid connect endpoints via the discovery document at .well-known/openid-configuration, including authorization and token endpoints, user info, jwks_uri, and the photos service endpoint.

Master the authorization code grant type by constructing the authorization request, exchanging the code for an access token, and calling the Google Photos API to fetch albums and photos.

Explore the authorization code flow with token verification, refresh tokens, and OpenID Connect, including token info, user info, jwks, and JWT structure, illustrated with Google APIs.

Discover how the PKCE extension strengthens the authorization code grant for public clients with a code verifier and code challenge, preventing interception and unauthorized token issuance.

Explore the implicit grant type, why it’s insecure and deprecated, and when PKCE-backed authorization flows should be used for public clients like browsers and mobile apps.

Explore Google OAuth 2.0 playground to obtain and inspect access tokens for Google Drive read-only scope, using authorization codes and tokens, with server-side and client-side flows.

Showcases how to build a Java Spring Boot app that uses Google OAuth 2.0 and OpenID Connect to obtain tokens and fetch albums and photos from the Google Photos API.

this lecture walks through a spring boot oauth2 client that authenticates with Google, obtains an access token, and retrieves Google Photos albums and photos via rest template.

Explore debugging OAuth flows with Google Chrome dev tools, inspecting HTTP messages, redirects, and authorization code exchanges between the browser, Spring Boot app, and Google accounts.

Explore enterprise OAuth 2.0 with Okta, set up an enterprise authorization server, define custom scopes, and use client credentials and resource owner password grants with a Spring Boot resource server.

Set up Okta and create OAuth 2.0 clients, exploring the default OpenID Connect authorization server and its endpoints. Manage users, groups, and redirect URIs, and configure scopes and token settings.

Build and secure a test resource server with Spring Boot, protected by an Okta authorization server, validating JWT tokens and enforcing Facebook API dot read and dot admin.

Explore the resource owner password grant with Okta, obtaining access tokens with OpenID, profile, email, offline access, and refresh tokens, then call the fake book api end-to-end.

Explore Okta’s OAuth and OpenID Connect features, including identity providers, on-prem AD FS integration via SAML, and token claims configuration.

Explore Okta's OAuth 2.0 and OpenID Connect flow through a hands-on assignment: configure discovery, authorize, obtain tokens (access, id, refresh), introspect, revoke, and test client authentication methods.

Enable secure access by swapping Google for Okta in a Spring Boot client, using a fake resource API to fetch albums and photos, validated by the photolibrary.read scope.

Builds a Spring Boot resource server that verifies JWTs via JWKS from Okta, protects /fake albums with photolibrary.read scope, and serves hard-coded albums and photos in a stateless API.

Explore the anatomy of JWT tokens, how they are signed and verified, and use them for client authentication with public key cryptography, including Okta’s approaches.

Explore how JWT tokens are created and dissected, including header, payload, and signature, base64 URL encoding, and verification with public keys using RS256, RS512, ES, or HS.

Explore client authentication in OAuth 2.0 and OpenID Connect, detailing methods such as client secret post and client secret basic, plus JWT-based options for token, introspection, and revocation.

learn how to implement client authentication with jwt, signing with a client secret (hs256) or a private key (rs/es), and how the authorization server verifies the token.

Explore how enterprise OAuth 2.0 and OpenID Connect integrate LDAP, SAML, and cloud deployments to secure authentication across enterprise apps and follow best practices.

Compare social app scopes with enterprise groups and roles, noting upfront provisioning by administrators, data ownership by the app, and how authorization servers map groups to scopes.

Explore how enterprise architecture weaves SAML, OAuth 2.0, and OpenID Connect with an authorization server. Describe the auth code flow, tokens, and single sign-on benefits.

Explore how login creates three browser sessions—between the browser and the application, the authorization server, and the SAML identity provider—and how logout destroys these sessions through coordinated redirects.

Learn how enterprise applications assign scopes to users through downscoping, mapping AD groups to scopes or using ID tokens, unlike social apps that rely on user consent for explicit scopes.

Leverage role based access control by using groups in access tokens instead of application scopes, relying on OpenID scopes and group claims to authorize users across resource servers.

Implement role-based authorization in Okta by creating groups, assigning users, and injecting a groups claim into the access token for secure resource server access.

Explore RBAC in a Spring Boot resource server by switching from scopes to groups, using a JWT authentication converter to map groups to role authorities for enterprise authorization.

Explore cloud deployments of OAuth 2.0 and OpenID Connect, detailing central authorization servers, SAML identity providers, browser redirects, and multi-cloud edge cases.

Illustrate enterprise problem use cases by introducing the oauth2 authorization server to secure rest api calls across microservices and multi-cloud data centers, noting saml's limitations and openid connect integration.

Clarifies how OAuth 2.0 and OpenID Connect differ, explains when to use both or either alone, and covers ID token, scopes, and the user info endpoints.

Explore how enterprise authorization servers act as identity brokers to enable login across multiple authorization servers, including Facebook, Google, Apple, or Udemy’s own.

See how an authorization server acts as an identity broker, connecting to OpenID Connect and SAML providers like Facebook, Google, and Apple, packaging user identities into access and ID tokens.

Adopt PKCE with the authorization code grant for public and confidential clients, avoid implicit and resource owner password grants, use client credentials for machine-to-machine flows, and rotate secrets regularly.

Demonstrates single page applications built with Angular and TypeScript, using OAuth 2.0 flows: implicit and authorization code with PKCE against Google and Okta servers.

Build and explore an Angular app using the angular-oauth2-oidc module to implement OpenID Connect implicit flow with Google (configurable for Okta), enabling token-authenticated photo albums.

Integrate Okta with an Angular app using authorization code with PKCE, and access the local resource api on port 8081 to fetch albums.

Examine the implications of enterprise OAuth and OpenID Connect in JavaScript, compare implicit and authorization code with PKCE for single-page apps, and advise on secure library choices and session storage.

Explore how desktop applications securely integrate with the OAuth 2.0 authorization server using OpenID Connect and PKCE as public clients, without a client secret, via the front channel.

Learn how desktop apps securely authenticate with OAuth 2.0 using PKCE against the Okta authorization server, using a loopback redirect and an embedded web server to obtain access tokens.

Discover how mobile apps use OAuth 2.0 with OpenID Connect and PKCE, via a custom URL scheme and system browser, with redirect URI to exchange codes for tokens.

Explore how the device authorization grant enables OAuth 2.0 flows on devices with no browser, enabling activation codes and a multi-device login flow.

Explore how the device code flow works, verify server support via discovery documents, and implement polling, user code entry, and token refresh on public devices like smart TVs.