OAuth and OpenID Connect for PSD2 and Third-Party Access

Editor's Notes

1. A customer at a bank
2. The customer wants to give access to some of its to a third party app Direct access and screen scraping is no longer allowed The app is already registered as a trusted application
3. Four players User Third party app OAuth AS Microservices
4. Client pop ups a browser,
5. Points it to the OAuth server This request contains information to identify the client, and what access it needs delegated
6. OAuth server validates the request, and continues to authenticate the user
7. Strong authentication required, so some kind of second factor is applied during the authentication
8. The AS now knows the user, and can lookup the account
9. The OAuth server can now ask the user for consent, which finalizes the delegation.
10. The response is sent back to client with a one time code,
11. The code is passed to the client, which immediately makes a token request to the OAuth server
12. The code is passed to the client, which immediately makes a token request to the OAuth server
13. The code is passed to the client, which immediately makes a token request to the OAuth server
14. The code is passed to the client, which immediately makes a token request to the OAuth server
15. The API can now validate the token, and return the data
16. The reference token does not have a meaning for anyone else than the AS
17. Cleartext token, signed by the private key of the OAuth server
18. As you can imagine, we don’t want the by value tokens to be out on the clients, since that would give the clients more information than it needs. The info is for the api, not the client.
19. So in the case were the client has a reference token, it won’t have any meaning to to the apis
20. So in the case were the client has a reference token, it won’t have any meaning to to the apis
21. So in the case were the client has a reference token, it won’t have any meaning to to the apis
22. The API can now validate the token, and return the data This is inefficient. All APIs needs to ask the AS if the token is valid, and to get the token metadata to be able to take authorization decisions
23. So in the case were the client has a reference token, it won’t have any meaning to to the apis
24. So in the case were the client has a reference token, it won’t have any meaning to to the apis
25. So in the case were the client has a reference token, it won’t have any meaning to to the apis
26. So in the case were the client has a reference token, it won’t have any meaning to to the apis
27. So in the case were the client has a reference token, it won’t have any meaning to to the apis
28. So in the case were the client has a reference token, it won’t have any meaning to to the apis
29. Lets talk about the scopes and how they relate to the consent
30. The initial request contains the scopes that the client wants a token for
31. Skipping ahead, the user will be ask to consent to delegate access with the requested persmissions.
32. Lets talk about the scopes and how they relate to the consent
33. To
34. The initial request contains the scopes that the client wants a token for
35. Now the user has to consent once for every transaction But still, something is missing. It would be bnice to have some data in there that describes the operation that is about to be performed
36. To
37. All of the query parameters inside a JWT, that is signed with the private key of the client. When you get into the more advanced parts of OpenID, the parameters tend to grow, so building them
38. Now instead of passing all data as query parameters, we send one parameter with the JWT we created
39. All of the query parameters inside a JWT, that is signed with the private key of the client. When you get into the more advanced parts of OpenID, the parameters tend to grow, so building them
40. Now instead of passing all data as query parameters, we send one parameter with the JWT we created