Pass On Access: User to User Data Sharing With OAuth

on YouTube ↗20m

" summary

Demonstrates sharing a bike‑lock IoT (Skylock) account by turning OAuth’s user→app tokens into user→user delegation using OpenID Connect’s userinfo endpoint, issuing a second access token that names both the authenticating client and the resource owner. Compares two implementations: a central access table (DB lookups per microservice, high coupling) versus delegated tokens (JWT or reference tokens minted by the OIDC server, microservices only validate tokens). Shows a working prototype pattern and tradeoffs for token management and microservice scaling.

AI-written summary · about

" chapters (16)

1. 0:00Introduction
2. 0:56Skylock
3. 3:35Use Case
4. 4:13Sharing
5. 4:30Delegation
6. 7:00Access Tables
7. 9:38Microservices
8. 10:30Delegate Access
9. 11:00OpenID Connect
10. 12:05User Info
11. 14:40Access Token
12. 15:45OAuth Flow
13. 16:44Micro Services
14. 17:56Regular Access
15. 18:58Delegated Tokens
16. 19:16Conclusion

" related talks

• 31mOAuth 2.1 And OpenID ConnectAbdessamad Temmar · BlaBlaConf 2022
• 47mIntroduction to OAuth 2.0 and OpenID ConnectPhilippe De Ryck · GOTO Berlin 2018
• 28mOAuth 2.0 and OIDCSara Daqiq · Silicon Valley Code Camp 2018
• 19mOAuth and OpenID Connect for MicroservicesJacob Ideskog · Platform Summit 2014
• 33mOAuth and OpenID Connect Deep DiveTravis Spencer · Nordic APIs Stockholm 2013
• 54mWho's your user? OpenID from the ground-upJohannes Brodwall · Build Stuff 2019
• 39mSecure your APIs using OAuth2 and OpenID ConnectTravis Spencer · Oredev 2017
• 01h 00mImplementing OpenID Connect and OAuth 2.0 – Tips from the TrenchesDominick Baier · NDC Security Oslo 2020