Solving Identity Management in Modern Applications: Demystifying OAuth 2, OpenID Connect, and SAML 2

by Yvonne Wilson, Abhishek Hingnikar

Overview

Know how to design and use identity management to protect your application and the data it manages.

At a time when security breaches result in increasingly onerous penalties, it is paramount that application developers and owners understand identity management and the value it provides when building applications. This book takes you from account provisioning to authentication to authorization, and covers troubleshooting and common problems to avoid. The authors include predictions about why this will be even more important in the future. Application best practices with coding samples are provided.

Solving Identity and Access Management in Modern Applications gives you what you need to design identity and access management for your applications and to describe it to stakeholders with confidence. You will be able to explain account creation, session and access management, account termination, and more.
This expanded edition has been revised to provide an overview of the new version of OAuth (2.1)―the primary changes in this version, including features that were removed from 2.1 that were in 2.0 and why they were removed. The discussion of the book's accompanying sample application has been revised to cover in more depth the approach for developing the application (also revised). A new section has been added on the OAuth 2.0 Device Authorization Grant (RFC 8628) specification, which is useful for devices with limited UI capability. Minor additions include the topics of identity proofing, the need to capture and organize consent information, the impact of tracking prevention technology on certain identity prools, and the availability of additional options for authorization requests such as OAuth 2.0 Rich Authorization Requests and JWT-Secured Authorization Requests (RFC 9101).

What You’ll Learn
• Understand key identity management concepts
• Incorporate essential design principles
• Design authentication and access control for a modern application
• Know the identity management frameworks and prools used today (OIDC/OAuth 2.0/2.1, SAML 2.0)
• Review historical failures and know how to avoid them

Who This Book Is For
Developers, enterprise or application architects, business application or product owners, and anyone involved in an application's identity management solution

Product Details

ISBN-13:	9781484282601
Publisher:	Apress
Publication date:	11/18/2022
Edition description:	2nd ed.
Pages:	384
Product dimensions:	7.01(w) x 10.00(h) x (d)

About the Author

Yvonne Wilson is co-founder and Chief Strategy Officer for XploitDefense. She has had many roles in the software industry related to security and identity management as a security and identity architect; enterprise architect; director of developer success working with identity customers; sr. director of security governance, risk, and compliance (GRC); Chief Strategy Officer; and founder of cloud identity services. Yvonne was responsible for IT security strategy and architecture at Sun Microsystems, founded and designed the identity management services offered through Oracle Managed Cloud Services, created a GRC team at Auth0 and founded a world-wide developer success team for Auth0, working with customers and overseeing the creation of an identity management training program for customer-facing support and professional services engineers. Yvonne is currently Chief Strategy Officer at XploitDefense.

In working with business teams at Sun, designing and deploying identity systems for customers at Oracle, and while founding a developer success team at Auth0, Yvonne had the opportunity of working with many customers, from small startups to large enterprises. Her experience spans the implementation of SSO, identity federation, directory services, adaptive knowledge-based authentication, and identity provisioning as well as multilevel authentication systems with certificate-based authentication. She has worked with OIDC, SAML 2.0, WS-Fed, OAuth2.0/2.1, and OpenID. From this depth of experience, Yvonne realized the growing need for a basic overview of identity management concepts that is understandable to business application owners as well as architects and developers.

Abhishek Hingnikar is at Okta, the identity provider for the internet. He has several years of experience designing and demonstrating Identity Management solutions to customers using Auth0 using OAuth 2.0/2.1, OpenID Connect and SAML 2.0. His current focus areas involve Consumer IoT, Device Based Identity and designing solutions that explore web based identity in peripheral domains.

Table of Contents

Introduction

Offers an introduction to the book and sets the goals that will be achieved in the book, who this book is for and what this book deals with.

Chapter 1: Identity

This chapter explains the concept of Identity and what we mean by Identity throughout the book, it is used to create familiarity with digital identity and walks the use through where these concepts originate from.

Chapter 2: Establishing Identity

This takes a little in-depth approach towards identity and how identity evolved on the internet and how we went from admin party (a term used to denote a server where everyone has administrative access) to secured systems with multi-level identities etc.

Chapter 3: Using Identity

Explains how identity works for applications and modern systems, including: authenticating, deep links, how to protect multiple pages in your app (tell if user has a valid session), and SSO - Sharing identity between apps.

Chapter 4: Nothing Lasts Forever

A missing point in identity books is the cleanup—there are laws and increasing complexities today that get more and more involved as time passes. This chapter deals with what is done even on user end devices and what users should do, as well on the developer side on how to properly log a user out. Covers: Logout, Password Reset, Forgotten Password, and deprovisioning.

Chapter 5: Architecture

From this point on the book takes a deeper turn targeted towards architects, which helps developers and architects focus on how to visualize and develop identity architectures. It covers Trust, PSP, PIP, PDP, PEP, Enterprise Identity, User-centric Identity, and current Identity Providers.

Chapter 6: Failure is an option!

Every now and then we often find a security vulnerability making headlines in the news, this chapter aims to explain what happened wrong on a higher level and then provide pillars on how to avoid them

Chapter 7: Looking into the Crystal Ball

A look into the horizon of identity, privacy and security today. This chapter talks about the bleeding edge work in cryptography.