Home > OpenID Connect OAuth Server by DnC

OAuth Server by DnC (OAuthSD) is an authentication server that implements OAuth 2.0 et OpenID Connect.

Secure data access with OpenID Connect

With the Single Sign On (SSO), an entity allows users of its applications to seamlessly navigate from one to the other. But even more:

By centralizing the authentication of applications and users, an OpenID Connect server makes it possible to perfectly control access to sensitive information.

In practice : "Authorization Code Grant"

When an application needs to authenticate user (for example to access protected resources), it will contact the OpenID Connect server. The latter identifies the application by exchanging with it an authorization code.
The server identifies the user of the application and determines its rights on this application. The user gives his consent to authorize the application to use all or part of his personal data.

This results in an authentication, binding the user and his personal data, the application and the rights of the user on the application (or vice versa) into a tamper-proof and transmissible object called Identity Token ( IDToken ).

The application then uses the Identity Token to access protected resources and obtain or modify data based on the rights of the user.

Different flows for different configurations

All application, server, and resource configurations do not provide the same level of security, especially for authenticating the application.

For optimal security, the application should be of "web" type and implement the Authorization Code Grant.

However, OpenID Connect can meet different needs, especially for mobile applications, with different Grant Types.

Supervision: organizing the configuration of the rights

In a large entity, with several thousand end-users (both staff and customers) and a large number of applications, it will not be possible to centralize the management of individual rights in relation to applications because they will be distributed users and applications among members of the entity.
A specific application will have to delegate the configuration of rights to the local level. Such an application is not part of the OpenID Connect specification. OAuthSD offers external applications the means to manipulate the data of the server through a HTTP API REST + TreeQL whose access is secured with ... OAuthSD.

Using an existing identification system: LDAP etc.

An organization implementing an identification system already has the means to manage users and their profile. OAuthSD allows the integration of third-party identification systems, whether standard such as LADP and Active Directory (Kerberos) or organization-specific (ID card, biometric identification ...).

In this case, the HTTP REST API makes it possible to automatically integrate this data by the authentication server. The result is a configuration in which the authentication server delegates the user’s identification to an Identity Provider.

The OpenID Foundation: standardization and certification

The OpenID Connect standard is coordinated by the largest IT companies within the OpenID Foundation. An abundant documentation provides the technical framework for the development of an authentication server (called "OpenID Connect Provider" or OP).
A battery of tests, made available by the foundation, allows the OAuthSD server to obtain the OpenID Connect Certification. This ensures that the authentication server conforms to the current state of the standard. A server should be updated and regularly tested.

What implications for client applications?

"Client" applications must be able to delegate user authentication to the OIDC server. More and more applications offer this possibility in accordance with the OpenID Connect standard.
When this is not the case, a special development is needed to adapt the application. This usually involves substituting an OIDC module for the code of the classical connection. Adaptation is therefore particularly easy in the context of a new development or an "open source" application.

DnC supports you

DnC supports you in your OpenID Connect project to implement your own OAuthSD authentication server. Our vertical mastery of the subject allows us to assist the developers as well as the project managers and the project owner.

DnC is an independent company guided by the consultant’s ethics. By entrusting us with the building of your own authentication server, you can rest assured that your customers’ browsing will not be exploited for adverse advertising purposes. You can also avail yourself of a policy of protection of their personal data.

Latest articles :

Use :

Signing on OAuthSD


As an application user, sign on this OAuthSD server to take advantage of OpenID Connect technology: a single login and password to identify you on compatible applications.
The information that you will be asked for is stored on the authentication server. They are transferred to applications under your control. They are mostly used by these applications to identify you and allow you to access different features andremain private.
With OAuth Server by DnC, passwords can not be intercepted (...)


Legals


Warning
Warning: This site is a demonstrator and a development tool, it may be unavailable and the saved data deleted at any time.
This application is a prototype in development. It is intended to enable DnC, its customers, and developers to test OAuth in their client applications and protected resource servers. Any use is at the risk of the user.
The documentation is also in constant becoming and can not replace the documents to which it refers.
The user should be aware of the (...)


OAuthSD Service for Lusitanian/PHPoAuthLib


The Lusitanian / PHPoAuthLib library provides oAuth support in PHP and is very easy to integrate into any project requiring an OAuth 2 client.
This article presents the OAuthSD service code to include in the library.
If the Oauthsd class is not provided by a plugin or an extension, the code below must be inserted in the library at the location and under the specified name:
... /vendor/Lusitanian/oauth/src/OAuth/OAuth2/ Service/Oauthsd.php
Notes:
The scope openid indicates that we use (...)


| 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 |

Site Map :