1

When protecting APIs using bearer token authorization:Is there a need to validate that the token was issued from my identity server or its already happening in the background and how do I do that?

What role do scopes play when it comes to bearer tokens?

John Korsnes
  • 2,277
  • 2
  • 20
  • 31
Hussein Salman
  • 7,806
  • 15
  • 60
  • 98

1 Answers1

3

In short, yes you need to validate that bearer tokens are issued by a issuer you trust. That means either by validating that it's signed by a trusted issuer, or making a API call to the isser you trust to ask it if it indeed is issued by the issuer you trust.

In practice: when talking about Katana, this is done by using a combination of [Authorize] filters/attributes and Owin middleware:

Option 1

The middleware from Microsoft:

app.UseOAuthBearerAuthentication(opts)

https://msdn.microsoft.com/en-us/library/owin.oauthbearerauthenticationextensions.useoauthbearerauthentication(v=vs.113).aspx

https://www.nuget.org/packages/Microsoft.Owin.Security.OAuth

Or, optionally, the middleware from Brock Allen og Dominic Baier:

Option 2

using the following abstraction that builts on top if Microsofts middleware (IF you need the extra features it provides):

app.UseIdentityServerBearerTokenAuthentication(opts)

Source: https://github.com/IdentityServer/IdentityServer3.AccessTokenValidation

NuGet: https://www.nuget.org/packages/IdentityServer3.AccessTokenValidation/

Scopes

When it comes to scopes & API access, scopes are something that represents the resources you want to protect. When a client asks for a access token, it can ask for a token to include a given scope. Your identityprovider then validates that this client is indeed allowed to receive a token with this scope. If successful, the end result is a token allowing the client to call a API using this token.

Since the API trusts token issued by this identityprovider (or token provider), all it has to do is to

  1. Validate that that the token is issued by someone that API trusts
  2. Check that the token contains the scope that represents it's resource
John Korsnes
  • 2,277
  • 2
  • 20
  • 31
  • So using option 2 is enough, I guess whats happening there is check if token was granted by issuer where resource type is also the same. But what if somebody uses my Identity server to get a token, then he can access my apis if he specified the correct resource type (since it will be there in the js application). Which part of the system will guarantee that it will not be compromised (Is it just the credentials provided to get the token)? Thanks – Hussein Salman Sep 27 '16 at 17:58
  • 1
    How it's secured: For an application to get a token, it needs some information that is secret between the application and the idserver (client secret), or hosted at a server you control (implicit flow : using redirects to callback urls that you've whitelisted at each client). – John Korsnes Sep 28 '16 at 10:14