technical background of vz-id

VZ-ID The technical background

Bastian HofmannVZnet Netzwerke Ltd.

VZnet Netzwerke Ltd. -‐ Tuesday, December 7, 2010

Agenda– Sharing• OExchange• OpenGraph

– Login• OpenID• OAuth & OAuth 2• OpenID Connect

– VZ-‐JavaScript Library

Sharing

OExchange• Common API for publishing sth. into social networks

http://www.example.com/share.php?url={URI}&title={title for the content}&description={short description of the content}&ctype=flash&swfurl={SWF URI}&height={preferred SWF height}&width={preferred swf width}&screenshot={screenshot URI}

hQp://www.oexchange.org/

Discovery over XRD<?xml version='1.0' encoding='UTF-8'?><XRD xmlns="http://docs.oasis-open.org/ns/xri/xrd-1.0"> <Subject>http://www.example.com/linkeater</Subject> <Property type="http://www.oexchange.org/spec/0.8/prop/vendor"> Examples Inc.</Property> <Property type="http://www.oexchange.org/spec/0.8/prop/title"> A Link-Accepting Service</Property> <Link rel= "icon" href="http://www.example.com/favicon.ico" type="image/vnd.microsoft.icon" /> <Link rel= "http://www.oexchange.org/spec/0.8/rel/offer" href="http://www.example.com/linkeater/offer.php" type="text/html" /></XRD>

OpenGraph

hQp://opengraphprotocol.org/

Retrieves meta data through meta tags in shared page

Sharing examples @VZ

hQp://developer.studivz.net/wiki/index.php/Sharing

http://platform-redirect.vz-modules.net/r/Link/Share/?url=http%3A%2F%2Fwww.example.com&description=descripton&title=title

http://www.studivz.net/Link/Share/?url=http%3A%2F%2Fwww.example.com&description=descripton&title=title

Iden@@es in real life

Do you have really only one iden@ty?Lothar Krappmann:

-‐ IdenVty is conveyed by communicaVon

-‐ IdenVty is not fixed but recreated by every communicaVon with your fellows

-‐ ExpectaVons of different people result in different idenVVes

Example:

Paul AdamshQp://www.slideshare.net/padday/the-‐real-‐life-‐social-‐network-‐v2

Iden@@es in the Web

Register, Register, Register, ...

Single Sign on

ul_Marga

MicrosoK Passport / Live ID

• Windows Live ID• Launched 1999 as .net Passport• Used mainly for Microso] Services but not much outside

• OpenID Provider since 2008

Facebook Connect

TwiSer @Anywhere

And there are much, much more

Vaguely Artistic

Nascar problem

How to fix it?

Aggrega@on: Janrain

hQp://www.janrain.com/

OpenID

• Open decentralized user authenVcaVon

hQp://openid.net/

Connec@on Flow

Authen@ca@on vs Authoriza@onWho is the user?

Is this really user X?

Is X allowed to do something?

Does X have the permission?

Client sites want more than just a unique identifier (Social Graph)

But there are Spec Extensions

decafinata

OpenID + OAuth

• Combines OpenID AuthenVcaVon and OAuth authorizaVon

openid.ns.oauth=http://specs.openid.net/extensions/oauth/1.0&openid.oauth.consumer=123456

openid.ns.oauth=http://specs.openid.net/extensions/oauth/1.0&openid.oauth.request_token=7890

OAuth 1.0a Flow +----------+ +---------------+ | -+----(B)-- Request Token -------->| | | End-user | | Authorization | | at |<---(C)-- User authenticates --->| Server | | Browser | | | | -+----(D)-- Verifier -------------<| | +-|----|---+ +---------------+ | | ^ v (B) (D) | | | | | | ^ v | | +---------+ | | | |>---(A)-- Redirect URL ---------------| | | Web |<---(A)-- Request Token + Secret -----| | | Client |>---(E)-- Request Token, Verifier ----' | | |<---(E)-- Access Token + Secret -------------' +---------+

Every Request: Client Credentials, Nonce, Timestamp, Signature

hQp://oauth.net/

Failures of OpenID 2.0

• Complex to implement

• No markeVng– Do you have an OpenID?–What is it?

• URL as idenVfier => Bad User Experience

OpenID Connect

• Goals:– Easier to implement–More simple specificaVon– BeQer user experience

• => wider adpVon• Built on top of OAuth 2.0

What‘s wrong with OAuth?

• Does not work well with non web or JavaScript based clients

• The „Invalid Signature“ Problem

• Complicated Flow, many requests

What‘s new in OAuth2? (DraK 10)

• Different client profiles• No signatures• No Token Secrets• Cookie-‐like Bearer Token• Mandatory TSL/SSL• No Request Tokens• Much more flexible regarding extensions

hQp://tools.iej.org/html/dra]-‐iej-‐oauth-‐v2

Web-‐Server Profile +----------+ Client Identifier +---------------+ | -+----(A)--- & Redirect URI ------>| | | End-user | | Authorization | | at |<---(B)-- User authenticates --->| Server | | Browser | | | | -+----(C)-- Authorization Code ---<| | +-|----|---+ +---------------+ | | ^ v (A) (C) | | | | | | ^ v | | +---------+ | | | |>---(D)-- Client Credentials, --------' | | Web | Authorization Code, | | Client | & Redirect URI | | | | | |<---(E)----- Access Token -------------------' +---------+ (w/ Optional Refresh Token)

What happend to signatures?

• Ongoing controvers discussion

• Bearer Tokens are fine over secure connecVon

• Vulnerable if discovery is introduced

• Or TSL/SSL is not possible

Scopes

• OpVonal parameter for provider specific implementaVons

• For example– AddiVonal return values– Access Control

OpenID Connect?

• Scope: „openid“

• With access token addiVonal values are returned– UserID: URL to Portable Contacts endpoint– Signature– Timestamp

hQp://openidconnect.com/

OpenID Connect Discovery

• Get IdenVfier of user

• Call /.well-‐know/host-‐meta file at the domain of the user‘s provider

• Look for a link poinVng to the OpenID Connect endpoints in the returned LRDD

OpenID Connect @VZ

• Available now

• But without the discovery part– No discovering clients– No discoverable enVVes

VZ-‐JavaScript Library

hQp://developer.studivz.net/wiki/index.php/JS-‐Library

Login widget

hQp://developer.studivz.net/wiki/index.php/JS-‐Library

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html> <head> <title></title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> </head> <body> <script type="text/javascript"> opener.vz.id.authStorage.setAuthParameterHash(location.hash.substr(1)); window.close(); </script> </body></html>

Callback.html

Thank you

hQp://twiQer.com/BasVanHofmannhQp://studivz.net/basVanhQp://slideshare.net/bashofmannbhofmann@vz.net

hQp://developer.studivz.net

technical background of vz-id

Technology

mapei adesilex vz

st um vz complete

broschuere msc ib vz

vz n7 2018 - id-zvonnica.ruid-zvonnica.ru › mag › vz ›...

child id approved background list

samopal vz 58 manual

new riegl...

vz portugues

vz predi 08 prez en - vz-2008 | predistribuce.cz

limit switch - vasto switch.pdf · 2019. 9. 6. · limit...

vz equity white paper

kr9700365-39p vz*

vz 58 military folder

ftp-vz-wave ftu-vz-wave ©2016fakro®21.01.16nc837-gb ·...

vz and superior

motorola solutions vz-18title motorola solutions vz-18...

vz front 2021

vz chiller series - daikin...

vz charity for clarity

kitchen vz jz czdz series czdz...vz/jz cz/dz kitchen...