Okta - OAuth 2.0 and OIDC (OpenID Connect)

Learn the essentials of OAuth 2.0 and OpenID Connect with Okta, including the authorization flow and core identity concepts explained by an experienced instructor.

Define OAuth 2.0 and OIDC, clarify authentication versus authorization, and explain key concepts like IdP, relying party, resource owner, client, and common endpoints such as authorize and token.

Trace the origin of OAuth from 2008, uncover why trust and security drove OAuth 2.0 to support non-web clients, and replace password sharing with secure delegated access.

Use a flowchart to choose the right OAuth 2.0 and OIDC flows (authorization code flow, implicit, client credentials, resource owner password), based on public versus native clients.

Demonstrate the authorization code flow for server-side apps, using a client secret and user authentication via browser redirects, exchanging an authorization code for access and refresh tokens.

Understand the authorization code flow: redirect to the provider for user consent, exchange the code for an access token, and use it to access user info and create an account.

Demonstrates the authorization code flow with Okta, guiding app integration and authorization code retrieval with postman. Exchange the code at the token endpoint for an access token.

Demonstrates a shorter authorization code flow, configuring the authorization and token endpoints, client id and secret, scope and state, and exchanging the code for an access token.

Understand the authorization code grant through an airport analogy, showing how a client exchanges an authorization code for an access token from the authorization server to access a protected resource.

Explore the authorization code flow with pkce, detailing how a code verifier and code challenge secure the process for mobile and web apps, culminating in access token retrieval.

Explore how PKCE extends the authorization code flow to prevent authorization code injection and protect mobile apps, detailing code challenges, code verifiers, and the authorization code to token exchange.

This lecture explains the authorization code flow and how PKCE adds a transformation method to protect against code interception, ensuring the client presents a secret to obtain an access token.

Explain the oauth 2.0 implicit flow for apps where the client secret cannot be guaranteed, detailing the client access token request, authorization endpoint, redirection, and access token response.

Explain why implicit flow is insecure and outdated, show token leakage via the URL, and recommend using the authorization code flow with PKCE for secure OAuth 2.0 and OIDC.

Explore the implicit flow by returning tokens directly from the authorization endpoint, with a nonce and OpenID scope, demonstrating token types, URL delivery, and its limitations for non-internal clients.

Understand the implicit flow by comparing it to the authorization code flow, where the access token is issued directly, highlighting token theft risks and the need for PKCE.

Explore the client credentials flow chart as a machine-to-machine pattern with server-side confidential clients, including token requests to /token and access tokens used by the resource server.

Learn the client credentials flow for confidential servers, a server-to-server grant with no user, not for native or browser apps, using the token endpoint with optional scopes.

Explore the device authorization flow in OAuth 2.0 and OpenID Connect, detailing device code and user code exchanges, verification URLs, browser-based user authorization, and use for input-constrained devices.

Understand the device authorization flow theory for input-constrained devices like smart TVs, where a second device authenticates via a QR code or URL, enabling two-device login.

Illustrate the resource owner password flow in OAuth 2.0, where the client exchanges user credentials for an access token (and optional refresh token) to access the resource server.

Explain the resource owner password flow, where the client uses user credentials and its risks, especially for mobile apps; note in-app login windows add security.

Explore the hybrid flow, which blends code and token approaches from authorization code and implicit flows to support apps needing user data and pre-processing.

Explore hybrid flows through three demonstrations and clear theory, combining authorization code and id token results with code and token exchanges at the authorization and token endpoints.