OAuth2 and OIDC demystified: with hands-on using Keycloak

Name: OAuth2 and OIDC demystified: with hands-on using Keycloak
Rating: 4.3 (19 reviews)

Designed for Understanding OAuth2/OIDC: When to Use Flows and How They Work Using Low-Level HTTP Requests

Created byZoran Petrovic

Last updated 9/2024

English

What you'll learn

Understand the core concepts of OAuth2 and OpenID Connect (OIDC)
Gain a clear understanding of OAuth2 and OIDC terminology, including roles, tokens, and scopes.
Develop the ability to choose the appropriate OAuth2 flow for different scenarios.
Learn to execute OAuth2 flows at a low level using direct HTTP requests.

Course content

3 sections • 12 lectures • 44m total length

About this course2:40
Demystifies oauth2 and oidc with hands-on practice, using Keycloak as a supporting service to build practical understanding of authentication and authorization through raw http requests.

OAuth2 protocol introduction4:41
Explore how OAuth2 replaces password sharing with access tokens that grant limited scope and expire in 30 minutes, and how it differs from OAuth1.
Terminology and flows6:13
Clarify oauth2 terminology and flows by detailing roles: resource owner, client, resource server, and authorization server; outline tokens such as authorization code, access token, refresh token, and grant types.
OIDC6:27
Explore OpenID Connect and how it builds on OAuth 2.0 to provide authentication via identity tokens (JWT) and standard and custom claims from an identity provider.

Prerequisites2:02
Install Docker and Bruno to test oauth2 grant flows, using Keycloak as the identity provider and Bruno to send http requests. Download Docker Desktop and Bruno, then import the collection.
Keycloak setup3:00
Set up Keycloak as an OAuth2 OIDC identity provider by running it in Docker on port 8080, creating admin and a user, and exploring the OpenID configuration and certificate endpoints.
Grant Types: Authorization Code10:01
Demystify the authorization code grant with a hands-on Keycloak workflow: create a client, configure scopes, and perform the two-step token exchange, including pixie for extra security.
Grant Types: Client Credentials1:32
Grant Types: Device Code3:05
Grant Types: Implicit Flow2:07
Demystify the implicit flow in OAuth2 with a hands-on Keycloak setup; build an implicit grant client and request a token, noting this flow is no longer recommended.
Grant Types: Password Grant1:30
Grant Types: Refresh Token1:06
demonstrate how to use a refresh token to obtain a new access token by posting to the token endpoint with grant type, refresh token, and client id from password flow.
OAuth2 Final Quiz

Requirements

You should have a basic understanding of HTTP. Some experience in software development is desirable

Description

Welcome to "OAuth2 and OIDC Demystified". This course is designed to equip you with a deep understanding of the core concepts and essential details needed to effectively use OAuth2 and OIDC in real-world scenarios. It is intentionally short and to the point, since I value your time. You can always re-watch some parts if you find them harder to understand, and I recommend you to do that.

What You'll Learn:

Core Concepts and Terminology: Fundamental components of OAuth2 and OIDC, including roles, tokens and scopes. Understanding these basics will serve as the foundation for everything you do with OAuth2 and OIDC.
Authorization Flows: Learn the different OAuth2 flows: Authorization Code (PKCE), Client Credentials, Device Code, Refresh Token, Implicit and Password. Discover when and why you should use each one, depending on your application's needs and security requirements.
Low-Level OAuth2: Test OAuth2 flows using raw HTTP requests. By understanding how OAuth2 flows work on low-level (instead of using libraries), you'll be better prepared to troubleshoot issues and ensure secure communication.

This course is intended for developers, architects, and IT professionals who are looking to deepen their knowledge of OAuth2 and OIDC. Whether you are integrating third-party authentication providers, securing APIs, or simply wanting to understand the technology better, this course has something for you.

You should have a basic understanding of HTTP protocol and some experience in software development is desirable.

This is NOT a course on how to use and configure Keycloak or any other identity provider, and this is NOT a course on how to use authentication libraries. The main goal is to understand OAuth2 protocol, how it works and how to use it.

By the end of this course, you will have a strong grasp of OAuth2 and OIDC and be confident in choosing the right authorization flows.

Join us on this journey to demystify OAuth2 and OIDC and take your authentication skills to the next level!

Who this course is for:

Software Developers, Solutions Architects and DevOps

OAuth2 and OIDC demystified: with hands-on using Keycloak

What you'll learn

Explore related topics

Course content

Introduction1 lecture • 3min

Understanding OAuth2 and OIDC3 lectures • 17min

Hands-on8 lectures • 24min

Requirements

Description

Who this course is for: