Sicurezza II, A.A. 2011/2012 OAuth Speaker: André Panisson, PhD student Università degli Studi di Torino, Computer Science Department Corso Svizzera, 185 – 10149, Torino, Italy Sicurezza II A.A

What is OAuth? o OAuth (Open Authentication) is an open standard for authorization Allows sharing user’s resources (photos, videos, contact lists) between different websites The user credentials (username and password) are not shared Websites share tokens instead of credentials Each token grants access to a specific website for specific resources for a defined duration OAuth is a service that is complementary to, but distinct from, OpenID. Sicurezza II, A.A. 2011/2012

OAuth vs OpenID o They both live in the general domain of security, identity, and authorization o They are open web standards o They both celebrate decentralization o They both involve browser redirects from the website you’re trying to use o But they’re different: they let you do different things Sicurezza II, A.A. 2011/2012

OAuth vs OpenID o Open ID gives you one login for multiple sites »OAuth lets you authorize one website – the consumer – to access your data from another website – the provider o With Open ID, there is no suggestion of two webapps sharing your data »With OAuth, any information you hold on any website can be shared with another website o With OAuth, you still need to log into the provider Sicurezza II, A.A. 2011/2012

OAuth Protocol Sicurezza II, A.A. 2011/2012

Example Provider: Twitter o Twitter (twitter.com) shut off completely Basic Auth on August 30th o If you have a Twitter account, you can become a Twitter developer: Go to dev.twitter.com Click “Your apps” Register a new application Choose Application Name, Description, Website Application Type: Browser … Register Application Sicurezza II, A.A. 2011/2012

Example Provider: Twitter o Registered parameters: API key Consumer key Consumer secret Request token URL: Access token URL: Authorize URL: o Twitter supports hmac-sha1 signatures, does not support the plaintext signature method Sicurezza II, A.A. 2011/2012

Obiettivo del laboratorio o Sviluppare un sito web minimale che effettui un controllo degli accessi tramite OAuth Integrazione con un OAuth consumer Interazione con un OAuth provider Sicurezza II, A.A. 2011/2012

Preparazione del laboratorio o Server Apache sotto la cartella $HOME/apache + PHP Sicurezza II, A.A. 2011/2012

OAuth Libraries o Sito ufficiale: o Installeremo un provider interno implementato in PHP Source code per diversi linguaggi: Disponibile in pachetto su Scaricare ed estrarre il file oauth-code.tar.gz: tar -xvzf oauth-code.tar.gz Coppiare tutta la cartella php nella document root cp code/php $HOME/apache/htdocs/oauth -R Accedere ai esempi: Sicurezza II, A.A. 2011/2012

OAuth Test Server o Leggere le istruzioni e provare: Getting a Request Token Getting an Access Token Making Authenticated Calls o Provare con diversi tipi di firme : HMAC-SHA1 PLAINTEXT RSA-SHA1 Sicurezza II, A.A. 2011/2012

OAuth Test Client o Leggere le istruzioni e provare a fare delle chiamate al provider: Request Token Authorize Access Token o Provare con diverse firme : HMAC-SHA1 PLAINTEXT RSA-SHA1 Sicurezza II, A.A. 2011/2012

OAuth Test Client o Provare con i parametri di Twitter: API key Consumer key Consumer secret Request token URL: Access token URL: Authorize URL: Sicurezza II, A.A. 2011/2012

Oauth - Exercise o Utilizzare la pagina Oauth Test Client con Twitter per: Creare request_token e request_token_secret Authorize Creare access_token e access_token_secret Sicurezza II, A.A. 2011/2012

Oauth - Exercise o Utilizzare i token creati per fare una request a un servizio Twitter: Creare un script php sulla stessa cartella dei esempi OAuth con il contenuto di questi due slide. Sicurezza II, A.A. 2011/2012 <?php require_once("common.inc.php"); // Classe per accedere a una URL utilizzando PHP class OAuthCurl { public function __construct() { } public static function fetchData($url) { $options = array( CURLOPT_RETURNTRANSFER => true, // return web page CURLOPT_HEADER => false, // don't return headers CURLOPT_FOLLOWLOCATION => true, // follow redirects CURLOPT_PROXY =>" //proxy address CURLOPT_PROXYPORT => 3128, // proxy port ); $ch = curl_init($url); curl_setopt_array($ch, $options); $content = curl_exec($ch); $err = curl_errno($ch); $errmsg = curl_error($ch); $header = curl_getinfo($ch); curl_close($ch); $header['errno'] = $err; $header['errmsg'] = $errmsg; $header['content'] = $content; return $header; }

Oauth – Exercise (cont.) Sicurezza II, A.A. 2011/2012 $consumer_key = “key"; // put your key here $consumer_secret = “secret"; // put your secret here $access_token = “token"; // put the generated token here $access_token_secret = “token_secret"; // put the generated token secret here // the service URL; see dev.twitter.com $service = " $sig_method = new OAuthSignatureMethod_HMAC_SHA1(); $consumer = new OAuthConsumer($consumer_key, $consumer_secret, $callback_url); $token = new OAuthToken($access_token, $access_token_secret); $request = OAuthRequest::from_consumer_and_token($consumer, $token, "GET", $service); $request->sign_request($sig_method, $consumer, $token); $oc = new OAuthCurl(); $reqData = $oc->fetchData($request->to_url()); $timeline = json_decode($reqData['content']); foreach ($timeline as $status) { print $status->text.' '; } ?>

OAuth 2.0 o OAuth 2.0: o Not backward compatible with OAuth 1.0 o Facebook's Graph API only supports OAuth 2.0 and is its largest implementation o As of 2011, Google added OAuth 2.0 experimental support to its APIs Sicurezza II, A.A. 2011/2012

OAuth: Altre implementazioni o Provare con l’implementazione in python sh export PYTHONPATH=$HOME/code/python python $HOME/code/python/oauth/example/server.py python $HOME/code/python/oauth/example/client.py Sicurezza II, A.A. 2011/2012

Esercizi o Google OAuth Playground: Creare un documento (rapporto) con tutti i passi per accedere ai servizi Google utilizzando OAuth in questa pagina Fare la correlazione con i passi dello slide “ OAuth Protocol ” Elencare il contenuto della HTTP Request/Response per ogni passo Da consegnare (in formato doc o pdf) dopo la lezione teorica su OAuth Sicurezza II, A.A. 2011/2012

OAuth Speaker: André Panisson, PhD student Università degli Studi di Torino, Computer Science Department Corso Svizzera, 185 – 10149, Torino, Italy Sicurezza II A.A Grazie per l’attenzione! Sicurezza II, A.A. 2011/2012

© 2009 by André Panisson. Permission to make digital or hard copies of part or all of this material is currently granted without fee provided that copies are made only for personal or classroom use, are not distributed for profit or commercial advantage, and that new copies bear this notice and the full citation. Sicurezza II, A.A. 2011/2012