OAuth2 profiles:OpenID Connect / UMA

Why adopt for IOT?

OAuth2Identity Standardspoised for significantsuccess...

WAM

* WAM = Web Access Management (SiteMinder, Oracle Access Manager, etc.)

OpenID Connect

http://openid.net/connect

Connect DiscoveryGET request to https://<host>/.well-known/openid-configuration

See specification: http://openid.net/specs/openid-connect-registration-1_0.html

See sample Response: http://seed.gluu.org/.well-known/openid-configuration

Connect Dynamic Client RegistrationSee specification: http://openid.net/specs/openid-connect-registration-1_0.html

See sample Dynamic Client Registration html form: http://seed.gluu.org/oxauth-rp

Connect Authentication, User Claims and Client ClaimsSee specification: http://openid.net/specs/openid-connect-core-1_0.html

Overview of four flows: http://www.gluu.co/connect-flows

Authentication + Claims != Access Control

Policy Decision Point UMA Authorization Server

Policy Enforcement Point UMA Resource Server

UMAWorking Group Home Page: http://www.gluu.co/uma-wg

By presenting an authorized RPT token, the Resource Server can verify that access has been granted.

The PAT and AAT are just for secure communication.

UMA does not...

● Define any policy expression language

● Say who makes the decision(although it defines capabilities to enable people to centrally manage policies)

Why adopt these two OAuth2 profiles ???1. 10 years of development based on 10 years of experience.

Both standards started around 2010. From 2001-2010 we gained critical feedback from developers on what kinds of APIs are needed for security.

2. Perfect fit for IOT--in fact designed to solve almost the same exact use cases.3. Does not assume cloud--just standardizes interfaces. Local authorizations

servers should use the same protocol as cloud servers.4. Proven usability by developers--OAuth2 is now industry standard and many

libraries exist. You can start simple.5. Small on the wire: json messaging uses less bandwidth and computing power6. Scales for high-end security requirements. NIST LOA 3 and LOA 4 deployments

are possible.7. Industry consensus exists for OpenID Connect: Google and Microsoft already

supporting it.8. UMA 1.0 standard to be announced at RSA Security in April, 2015