OAuth, OpenID Connect & .NET – the Good Parts
OAuth has been around for more than 10 years now, and has become the standard protocol for token-based security. Like every popular technology that has been growing with its requirements, there are some things which work really well, and some that did not quite stand the test of time.
2022 is an excellent year to either start learning OAuth & OpenID Connect from scratch or give them a refresher. With the upcoming OAuth 2.1 protocol revision, the protocol has been streamlined and simplified and the specification has been updated to meet modern application and security requirements. At the same time ASP.NET and .NET in general has excellent support for all the moving parts needed to implement an OAuth-based security system.
This full-day workshop teaches you all the OAuth you need utilizing the most common and practical techniques and libraries in the .NET ecosystem. Besides looking at built-in features of (ASP).NET, we will use popular frameworks like IdentityModel and IdentityServer, and we will learn how to use them to secure native/desktop and web applications as well as SPAs, Blazor WASM applications, APIs and daemons.
- OAuth history and motivation
- OAuth terminology and architecture
- OAuth 2.1
- Typical protocol flows and application scenarios
Machine to Machine Communication
- Client Credentials Flow
- Access tokens
- Token Management
- Simplifying protocol interactions with IdentityModel
- Automatic token management
- Writing daemons using .NET Workers
- JWT Bearer authentication handler for ASP.NET
- Authorization policies
- Authorization Code Flow
- Proof Key for Code Exchange (PKCE)
- The need for OpenID Connect
- Session management
- Refresh tokens
- Automatic token management with IdentityModel.AspNetCore
- Writing web applications using ASP.NET
Bringing it all together
- Integrating various applications into one coherent architecture
- Identity Providers & token services
- Federation gateways
- Web applications
- Native/desktop applications (e.g. Windows desktop or mobile apps)
- SPAs / Blazor applications
Dominick spent most of his professional career implementing security systems for his customers and reading protocol specifications. This resulted in a number of popular open-source projects like IdentityServer and IdentityModel. Since 2020 he runs Duende Software Inc together with his longtime friend and colleague Brock Allen. Duende provides a sustainable home for the IdentityServer project and is the one-stop-shop for all things OpenID Connect and OAuth for .NET-based companies.