OAuth and OpenID Connect Explained for Developers

[00:00:01][Music] [Music] d e d [Music] [Music] [Music] [Music] d [Music] [Music] a welcome net friends this is another episode of the on.net live show um if it's your first time tuning into to the show uh what we're all about here is empowering you our.net community to achieve more with the technology I'm your host Scott Addie and I'm joined by co-host my renzel and cam soer so if you're like me um you you hear these terms frequently um oo openi DEC connect or oidc you might hear o flows claims tokens at this point my brain feels like it's melting and I'm wondering what does it all mean well I'm happy to report that we're joined by Our Guest Leo Melone who was here today to help us all make sense of this Leo uh would you like to briefly introduce yourself to the audience yes sure thanks Scott yes my name is uh Leonardo melon um and I'm a software developer um in Spain I'm from Argentina I have a a little slide with some other details but basically uh I will try to to uh clarify some concept because uh is this the same as as Scot at first it was very difficult for me to to know exactly what is a scope and a flow and a grant so this why we are here so that's it yeah and I feel like this is a a scary topic you know many of us are are asked by our our managers hey just add off to this application make it happen and again we're we're kind of like well we recognize it's important but we may not fully grasp the fundamentals of it so Leo I know you have a slide deck you wanted to present to us today to kind of break down some of these topics why don't we start there yes sure sure let's get started um so first of all uh let me put this in here um can I start now okay yeah okay as I mentioned for my name is l mik I'm from Argentina you know the Freetime uh football champion and I'm from Argentina but I live in Spain uh near Madrid in a little town in Toledo uh and I work in TOA as a software developer architect and I am also a Microsoft MVP on development Technologies and I'm also a noo Alo Ambassador so that's my background I'm am programming uh for the last 20 years so um this is the agenda for today um the main goal of this presentation as we said before is to have a as clear as possible idea of the main Concepts on o this is a very extensive topic with a lot of details a lot of specifications we we will just cover some surface details but I think uh that will be enough to understand and and go deep for ourselves so how it works why things are the way they are what is a client what's a flow scope which one should I use I may will I may will round off time because you know it happens to me all the time but it's a lot of of information to cover um but I will try to focus on the basics so if anything is left out we we can we can um see uh in our own later so first of all let's get started with the topic uh does anybody recognize this stream uh this is this is kind of old uh this is a let's say social network uh called gel nothing special on this is just an example and um I don't know if is on business anyway so jel as other social networks needs people to join and remember this is quite old not too much but a lot of things have changed since this happened um so in order to do that jel is asking you to invite your friends to join the network from your contact list in other platforms like um msdn Yahoo American line you know is quite old and so but if we look closely the scream is a form a form that is asking you for your credentials I mean your user email and your password to access to Gmail so I I'll give you two seconds to think about it a website is asking you for your email address and your password to access to your contacts so this is not good sorry I heard something okay sorry you can keep going yeah sorry I heard something in the background sorry and so as I say as I was was saying um they ask you for your your credentials to access to you your email account with your credentials and look for your contacts and send spam or or or an invitation and in your behalf because has your credentials and with a look that will be all let's say so I I made this beautiful diagram about what's going here uh what's going on here but it's simple but Yelp is trying to access to our email account to get our contacts okay this is this is me or you just we are not playing any role now but but if you think this was only a isolated uh social network you're wrong other websites like in this case Facebook at the beginning did the same thing asking you to give them your credentials to access to your Gmail account Yahoo Windows Mail Etc you may think okay it's wrong it's really wrong but at the end of the day it's a social network so not something not so serious we are quite okay okay but the next screenshot I have is this Bo taken by me long story short since I am from Argentina and I live in Spain time to time I say send money to Argentina to pay some stuff doesn't really matter but this is a quite popular transfer money service this screenshot maybe two years old I hope this has changed I don't know uh so in order in order to transfer money from Spain in this case to Argentina you need two Banks two Banks accounts or at least one one uh one in Spain from where you get the money and another to send the money uh but you need a way to access to the money in the first account in the Cs account okay this screen is asking you in fact it's asking me my credentials for my bank account as you can see here uh you can change is is blurred but you can change the the the bank uh and your document and your your ID I mean and and you need to put your credentials so the site can access to your bank account and act as you to get money and send it to the other account so this is this is worth I think and I hope they didn't store your credentials into this their system I hope so this is quite the problem okay so what what's going what's going on here let's think an external application needs access to some resource let's say the transfer service need access to your bank account to do something or Yelp is need access to your contact list a resource let's say and this resource is in another application so I uh improve the previous diagram with some new with some terminology um Facebook in this case is trying to access to our email account let's call it results provider because our email account is where the resource is located in this case the resource is the contacts we are the resource owner because we own own the resource okay so nothing fancy here but with more detail and using W terminology Facebook a client tries to access to a resource provider our email account to access to our resource contacts and in order to do that needs to login or to prove identity against an identity provider in this case the identity the provider and the resource provider is the same application it's not always like this for example um we can think about Google for example we log in the same stream the same Google login stream to access to different Google services Gmail uh Drive Etc this is a good example of a central IDP identity provider IDP with different services or different resource provider this is a very common scenario um and and is a good example of a single point of failure but uh not always the IDP and the resource provider are the same application or I must say it's the less common in scenario than the IDP and the resource provider provider are the same application of course um this is quite simplified but let's go on so what's going on here again an external application a client need access to some resource this resource is in an external entity a resource provider so the client needs credentials to get the resource I I I'm going slow because this is is very important so there are some little problems as we as we saw we are given our credentials to an unknown application the application will access not only to the resource itself but to all the resources in the account I mean if I am giving my credentials my email account credentials to someone it can access to my email address my emails send emails in my name in my behalf Etc um this scenario the the first scenario is exactly the same or similar to give the cinema Hall keys to all the people that want to watch a particular movie I mean if you you you are you are giving the keys to open the cinema Hall and access to one movie and another movie another movie for any unlimited time is not ideal but this is quite what is Happening Here what if what if the identity provider gives some type of ticket or token to the client this token or ticket has no relation with my credentials like a Cinema ticket this token only allows the client to access to a specific resource a specific movie or only to my contact list and what if the sto this token has a limited lifetime for example 1 hour one the movie in this uh at this time Etc so here's where we start talking about o this is the this is taken from the official documentation from the official page of O um all this first of all let's let's clarify um the difference between between authentication and authorization because this is quite important authorization is when you um you have a rule to allow someone to access to something I don't know what I just did okay um sorry um authorization is authorize someone to access to something and authentication is um as um is verifying that this person is who really they clim to be person or res or client or whatever so w is a is an authorization protocol only is in charge to authorize clients to access to resources I highlighted some parts but the the the more important is is the last one W essentially allows access tokens I I talk I talk about token or ticket let's let's call it token in this case access token because we are verifying access access token because W has more than one token access token because and in fact we are checking access allows access tokens to be issued to a third party client by an authorization server authorization server server identity provider it's quite the same it's not exactly the same but we will use the two words inter interchange it um with the approval of a resource owner the resource owner the the the owner of the resource has to approve the access and the third party then uses the access token to access to the resource hosted by a resource server so this is exactly what what we saw before we have someone that wanted to access to a resource in a resource provider either Source owns to someone okay this is all of terminology and this very important to to to remember this uh this terminology so there are several benefits if we if we if we do that no password is compromised if we give uh an application our credentials our password will be compromised and if we use the same password for different services I don't do that but maybe someone um other benefit is uh we limit the access uh in time and resource we only give access to a particular resource in a particular um time window and limited time and this is similar as I mentioned before to give tickets to a specific movie valid on a specific date so I made I improve the diagram at an incredible level so this is the the exactly flow that wealth uses to accomplish this this goal so we will see this in detail because it's very important to understand and this is the base for for the other uh interactions so Facebook the client the client is always an application users are never clients the clients are always applications first important uh point then Facebook ask the identity provider or authorization server for access the authorization server gives a token then Facebook uses this token to access to our resource provider and get access to the resource the resource provider validates the token the ticket the same as in the cinema valid ticket is valid for this date this resource this movie and Returns the resource to the client this is the exactly the flow that wal follows exactly at least in one case again as resource owner we are just here watching what is going on in the background we are not participation in this particular flow but we will we will in the future so uh let me check my notes okay so in the oous world we need an identity server or authorization server we need a client an application the client is always an application the user has nothing to do with authorization we need a res server that trust the IDP because the token will be um created by the IDP so and is the place where the resources are located the flow will be something like this the client starts asking the authorization server sending credentials the client has its own credentials for a token the both checks some information about the client Returns the token and then the client requests the resource using this token to the resource provider for example we logged in h us using our gole account and then using a token we access to the drive API or something like that then the the resource is returned by the the resource provided after verify the the token that's it it's quite simple but it's very tricky to understand we will see our first demo I will check first if I don't have any okay if I have any messages here okay so I will show a demo of this exactly flow very slow because as I mentioned before it's very important to understand the basics so I have some things here first of all I have a an API here nothing fancy it's just a net weather forecast API classic as you can see the code is not importance only this part I have configure the authorization uh using uh o and that's it it's the standard template when you create a new do net application I um also have here Postman and and there is a request to access to the API so if I try to access I received um I receive a unauthorized uh response because the API is protected so how can we using oou get access to this this API okay so let's go step by step first of all I have here an identity provider or authorization server in this case this is keycloak is a quite standard or popular um software um I have here some clients created I have a session is sa okay I have um we we don't we don't we we won't dive into into kloo today but I had uh some clients created here I created one here that is the ID is CC and you know um programmers we are lazy and then is configured to use um service account roles that is the name that kllo uses to specify uh the specific flow I'm trying to use we will see what flows are in just a minute so this is something that happens all the time you learn the theory behind oow and then you go and try to use a software like this like kclo or any other and they change all the the terminology for their own terminology like service account roles is client credentials Grant I mean why but anyway um and I have uh a password I mean this is this will be the username the client ID and the credentials is something like a a password for this uh this particular um client so how can get access to a token okay I can make a post a post code to this identity provider with this information to get a valid token as I as as we saw in the presentation so how can I do that I have a a collection here with some with some request H I'm sharing all this uh all this stuff and GitHub repository um but this is a client credentials request it's a post request nothing special the URL uh a particular endpoint and only um free Fields Grand type is the type of interaction that I want that I need to perform to get the token client credentials the client ID CC and the CLI secret that's it if I make the post I get a token amazing this is token we will see this in detail in a minute I can copy this token go back again to the weather forecast request go through the headers or authorization is the same I will go to authorization uh Tab and select bid token paste this right here and get a result okay what happened here first of all the token the token is like a Cinema ticket let's say has some information inside and in fact we can see this information with no limitations for example I can go to this URL you will get familiar with this when you start to work with you ORS and I can paste the information just like this returned by the the IDP and as you can see we can see the content of the token important here expiration expiration is er in 30 seconds I mean yes it's this minute okay I think this is is expired so if I try to post again unauthorize because the token was created for be valid for one minute only so I can make uh exactly what I said before I can create tokens with a very short period of time it's only valid for one minute this is ideal um because if I someone steals the token will be valid only for one minute but not always possible depending on the application and scenario so there are some other information here we will we will back to go back to here in a minute um what happened here exactly okay this is just in case uh the demo failed and first of all we use a specific interaction to get this token between the client and the authorization server this interaction this this flow of H post uh my client ID plus my credentials and get a a token is called authorization flow or Grant in this case client credentials authorization flow or authorization Grant and yes I think that answer is one of the questions that we have from our viewers so Kristoff was asking like how does the resource provider know about the token so good question good question good question good question is a very very clever question tokens as the as as this person asked how how first of all how if I can see the content of the token I know this token is valid and wasn't modified since the the IDP created okay first of all the token has three parts as we saw here toy here we have three parts red one this color strange color violet I think and blue a header a payload and a signature so how does it work first of all the IDP creates the content with some information the information it can change but we always will have the expiration the not used before and the issuer who created the token the subject the identification of the client and I think that's it the all the other information is optional so in this case key CL is configured to add this information but you can you can skip it or you can uh configure key clo to not create this information um exact okay so um the token is created a hash is calculated for this content and then using a private key a cryptography private key the um the identity provider U signs or encrypts this hash and add it to the Token as this signature so with a public key the resource provider can know that the token was created by the identity provider I mean um uh a synchronous Keys Works something like I have a private key and a public key if if I um encrypt something with my private key the key that only I have I encrypted something with this key anybody with my public key that is public is not important can the Crypt this information but cannot encrypt information so if you have my public key you can be 100% sure that this information was created by me and wasn't Modified by anyone else or anyone else without the private key so with a private key the content is signed this signature is verified by the resource provider using the public key and the the question was how the resource provider knows about the IDP there's something I didn't say but it's a very good question that's why it's a very good question when I configure this here in this case this is particular of asp.net uh depending on on the technology the the name of this property can change um but in this case when I set up this URL here this is the URL of the of keycloak let's say so automatically net checks this URL and gets the public um the public key how okay I will talk about it uh in two minute but let's see it now because it's very interesting it's very interesting if I can find okay here settings here if I go to here this is the the same URL is um configure in as.net and then this is a this is standard we will see it in in in a moment this is standard so when I put this this URL here sp. net because is standard knows how to add or knows that sorry that adding adding this can access to this information this information is a standard of the protocol and here you can find the public key the public key isy uh is here I don't remember exactly where but you have the URL of the public key in some place here but this is how it works uh basically Al the resource provider needs the URL of the IDP to get this metadata metadata or Discovery endpoint and get the tokens in fact if you look closely this page knows that the signature is correct how okay you can see signature verified how it happened this happened because this page read this URL sorry this URL and did the same added the slash. wellknown slot open ID configuration part and get the the public key and verify the signature automatically I don't know if I we can see it if I do it again but it's just like like this so um yes here can see as soon as I paste the information this page go to open ad configuration endpoint to retrieve deserts here's a response and then another request to get the keys then using this Keys the resource provider verified that the s that the payload wasn't changed so it's a very clever mechanism so these type of things are very important because if when you try to configure for the first time all this stuff if you have something wrong or something for example I I I found some problems working with the graph API because the the signature mechanism is quite special and for example if you try to paste a a token created by the by the old graph API this will fail because the I think the the algorithm is not standard in the header you can find here the algorithm used to to create the the hash um but this is how the resource provider knows that the the token was created and wasn't modified okay good question so next um here okay so this is exactly what I was okay so as I said before the this particular um interchange of information between the client in this case Postman and the IDP is called client credentials authorization flow or authorization Grant client credentials it's very popular because is the only one that we will use always for this type of scenarios we have an application with no user interaction that tries to access to some API for example if you try to create an application that can access to let's say some Google API or something you will be asked to create a client and Cent credentials and stuff that will be the case so but W has um several flows implicit flow code flow code flow plus pixie resource owner device hybrid we won't cover all the the flows because as I said when I start we will run out of time but uh but in but we will see uh the the the more the more important as I you may notice no human has participate on this operation because C credentials is for robots or applications the question is when we need a human to interact okay this scenario is more similar to the previous to the gelp thing this is for example this is a session is site is website uh that um ask us to register uh so we can register in the old way using a username and or email and password maybe a verification link will be sent we need to create a new password following some security criterias Etc so we may use the same password we using other services because we are lazy so this is okay but as um everybody knows this is Ted use and maybe a deal breaker for new users to join so the question is how can I use o to to avoid to have to complete all the information that I already complete in other um in other applications okay this is why uh o is is useful Leo if you don't mind I have a a question I want to pop up on the screen tell me here um we have a viewer asking um about checking the expiration time of the token who response which component in this flow is responsible for checking expiration very good question very good question um at the end of the day the resource owner is who's checking the token I mean ER if I receive a token that is uh out of uh the time when it's valid is responsibility of the resource owner in fact if you see here I added this this um this parameter because um by default esp.net has a toleration time that I think is five minutes after the token is is out of time um so I put it to zero so my demo work um but this is responsibility of the the resource owner the resource provider because is who is checking the the the token this is this is is interesting because uh was hard to find this this by default has it's always there there is always a a a period of time that it doesn't matter if the token is is is um is out of the valid time because you know I just created the token and I used the token one minute after it was created and was valid for a minute and to to avoid this this this uh this um cases edge cases H you always put a toleration time so it's in is responsibility of who is consuming the token um so um yes so as I was mentioned um this is the most uh the one of the more interesting scenarios uh I need some information for a user I mean I want users to register in my site but I don't want they to to have to F all the form the name the username all this stuff so I can ask someone else that already knows this information to fill automatically this information so for example in this case I added these uh social network buttons and what happens behind the scene is exactly o out when you press for example the Microsoft login button you will be redirected as you can see the URL has changed here I was ining this and then when I press Microsoft I was redirected to the Microsoft login page then when I logged in using my Microsoft credentials in the Microsoft site using the the all the multiactor authentication all the rules that I have set up before in this uh particular IDP I uh get return to the the previous screen with my information field how does it work this is very clever and as as I mentioned but okay the application need to register but okay uh to avoid the process of entering our email name Etc it will ask someone else that already knows this information in this case any of this uh uh Network or applications so how does it work this is the flow we will see a demo in a minute um the user the user a person clicks on let's say Google button then the client redirects the user to the out server this case the Google account or Microsoft account when the user uh enters uh Val cred is redirected again um is redirected to the sorry is redirected to the Google screen enter credentials the credentials are validated by Google or Microsoft and a token is return to the client with some additional information for example the name and the username exactly and and so on so we need the participation of a user because the information owns to the user we need a web browser because internet in the previous case in client credential case we we didn't need a web browser we need to Red the client so the person enters credentials and authorize the client then the token is return with additional information this flow is called implicit flow it's important so let's see a little demo about it I have um this API I want use API I have here um an angular application this is just a an example I found in on the internet that I um just uh modified here I modified the configuration to use as Authority my key clo I put this information okay sorry uh the name of the client and some other stuff that that we'll see in a minute uh so let's first of all check the configuration um here ky clo I will close these screens uh in Kick loog if we go to the client tab we'll see the implicit client that was created by me one hour ago so uh the name is simplicit and there are two very important uh pieces of data here the r URL as we saw before after the user LS in the IDP redirects the user again where here this is very important because I think 90% of the cases that I find some o configuration invalid is because of the URL the return URL and it's very important because in the return URL as part of the return message the the the rection the I HTTP rection is the token so this is very important so this is the log out it's not so important but it's important this is the the main the main piece of data that we have to to set up correctly so um we don't have the credential St because we are in a browser we can use credentials in the browser because that will be ridiculous so client ID and redirect URL and if I go here and paste this URL I will copy I know that if I press control plus C I will stop the website no okay uh let's go here let's go to Chrome and let's see what's what [Music] happens where is this here okay Network paste it right here to I was redirected to the IDP so the first step we saw before as soon as I we we don't have the the loging with key clo button but is automatic but it's exactly the same if I uh press h a button and in the red Direction there are some interesting information let's put it in a notepad to key uh client ID implicit and red redirect URL uh URL encoded but the URL okay so the the two main information parts so I enter my credentials I have a user called dardo because I'm very I have a lot of imagination so uh and if I click here signing I am redirected again to the rection URL what happened behind the scenes exactly that um I was redirected to my IDP and after I enter my credentials I was redirected to the redirection IDP and as you as you can see here this is the red Direction and as you can see here I don't know if you can see it because it's very small but the token is right here in the URL this is important because this is access token here this is token and and we can we can see this token and paste it and look inside it in this case um because when I ask the when I configure the the client I ask for a special scope scope is the same is a name form resource I mean I can have a resource that is let's say the my contact list and I can call it contacts or an API I can call it read API and for administration matters I can call it uh admin API and then I can ask in the client for this particular uh scope this scope is called open ID this is a standard name and it means uh information about the user so when I um get a token from the IDP the user information is in the token as you can see I have the given name family name the email so a website like uh sist can use this information to fill my the the sign up form and that's it it's done so very interesting but this is okay okay so in the presentation again is something uh failed I have some screenshot that I previous took um same here okay to have in mind the r URL is very important it's the most important part the r URL has a token because it's a redirection so we cannot refresh the token it's not allowed to refresh tokens I mean if the token is only valid for a period of time of 1 hour after this this hour the user will have to log in again okay so if I uh set the life term of the token the two weeks if someone steals the token game over H for two weeks um because if you seen the IDP doesn't Store The Tokens The Tokens are are automatic validated by the resource um server how checking the signature so the resource provider never ask the IDP if the token is valid only checks the signature so if I if a token is is stolen it's it's basically game over okay so refresh is not permitted in in implicit flow because implicit flow uh has this little drawback that we canot use a secret because it's a web browser and since the token is returned in the right direction an interception is possible for example in a public Wi-Fi of or the URL will remain in the history of the browser because it's our URL or if we are using something like a u Google Chrome session that we share between all the the the PCS where I I'm using the same browser with the same user so this is no ideal but um this flow was designed in a moment where browers were more limited for example the course standard didn't exist or wasn't so popular so at this point of the history this was the best option so now it's not more recommended and as as I as I as I said we are running out of time so what is recommended code flow what is code flow I will be I will be a little with a little more of speed um code flow is an improved version of implicit flow it's quite the same I press a button or automatically I'm automatically redirected to my login uh with my client ID my callback URL is the same as the implicit flow maybe a Conant screen asking me if I want to give my email address and my username to to the Facebook site Etc and then in the red direction there's no token there is a code a one use code temporal one use code this code is not important it's only used in a second um stage for the website the same website to ask again using client ID plus code for a token using a post ASX call so no reduction here no URL compromise and this is more secure again the redirection were in the in the implicit flow we had the the token now we have a one use only temporal code that only verifies that the user uh logs in correctly and accepted the consent screen and we can use it uh with our client ID to get a valid token and that's it and we can use the token token information or or use a token to access to some resour Etc so that's why code flow is recommended against implicit flow implicit flow is not recommended if you can can avoid use using implicit flow you uh you must use code flow so I said um but there's a will I will skip that there's um here's the the post here's the rection and here's the post made by the Cod flow behind the scenes and an additional configuration in key cloak will be um um besides the the valid URL web Origins again depending on the IDP we are using this name may change but basically um here I we have to put the valid course Origins when we use course we need to uh set up the the server to allow SE clients so we have to to add it here is another very common problem um the URL with a run setup so uh let me check because I can see the screen okay okay so uh considerations on the CL code flow the redution after login contains an unique one use code the code is used to request a token via post request using ASX calls course must be supported a token is not compromised and it's prefer option today against implicit flow so but there's anything else that is Pixie um cutf flow is the prefer option over in P top but but there's an extension called pixie that is recommended um finally the recommendation is use cutf flow with Pixie what is Pixie and short Wars pixie is like this exactly like this but um we add h a unique let's say password or random number here in the first call then the code is is return and when we um perform the request the token request we add the same or not the exctly same but uh a piece of information related with the first code we use here in the first request so the the IDP can know exactly that the person that is asking for the token is the same that start the started the the first request so this is Pixie in in in a few words but is an extension over over um code flow so open ID connect it is this is it is this is simple we are running out of time but this is simple open ID connect is O with a an additional layer to uh perform authentication we have walth we can get tokens we can get some information about token but we don't know exactly about the user I mean we have some information H in the token some claims with some information but we don't know all about the user or we cannot um validate the user so open ID connect basically adds some extensions to O it's the same so you will hear that people use um openconnect or o and is talking about the same because I I I nowadays everybody is using opened connect in fact nobody's using o only so it's the same um basically it's an extension and add some predefined Scopes we talk about Scopes Scopes are what I want to get the resource name I want to get from the from the dour server so add some predefine scopes for a for data for example open ID user profile and email this is the scope that we used before in fact when I uh shown you the the code flow um demo we I was using open open ID connect not W uh open ID is basically uh telling the the IDP uh also give me the information about the user user profile is the information about the user plus the email plus etc etc some predefined Scopes that's it and at an additional token we talk about the access token the token that is used to access to some resource but we add an additional token called ID token in this ID token we have all the information of the user maybe the address the job etc etc uh all this additional information is receiving in form of claims and Discovery endpoint the endpoint we saw before that's why I said that I plan to ask about it later the discovery endpoint the endpoint with the metadata the SL pun. wellknown do open ID configuration endpoint this is a part of the open ID connect uh specification um is a standard so always um it's always the same the URL and the content and the content scream is also part of of openconnect that's why I say that I I I I don't know nobody that is using o without opened connect because it's it's is free basically and the user profile endpoint this is new we have an endpoint that is called user profile uh that gives you in in theory the ID token with all the user profile information so open ID Conex is basically oou with some uh standard scope predefined to ask for user information and an additional token with the user information and the discovery or metadata endpoint and that's it um basically the opened configuration endpoint or the metadata is something like this uh as you can see we are here describe all the the endpoints for example the token endpoint and when you set up a client like I set up the the angular angular application before uh I only set the the root URL because um this librar is automatically knows how to search to add this part of the URL and look for this information and then they can know the token endpoint section endpoint user info endpoint Etc this can change so the the standard only defines this and obviously this keys but you can you can change this uh this uh endpoints and also we can find here the the flow supported by the by the IDP and a lot of other things like uh response types and um and also the keys the cryptography Keys as we saw before this is example of the token endpoint uh and this is the consent screen that we saw before this consent screen is part of the open ID connect uh protocol is basically asking you to authorize an application to access to your information because when you set up an a client to access to a user information depending on the configuration of the IDP uh may show a constant screen like this depending on the on the data you want to to get for the user um from the user and then the last one is the user info endpoint that is a an endpoint that you can access using the using the access token and get information about the user here you can find all the information about the user this is the other thing that is added by the by the standard and the search endpoint that we can see here that as we checked before was used by the do application to get the certificates the keys and and verify the the token um um obviously the user info information gives you information about the current user you cannot access to other users information because that will be wrong so one last thing uh what we haven't se today pixie in in deep device called flows refers token in a lot of details because as I mentioned when I started this is a very extensive topic with a lot of details and and I I I like to talk a lot and I I I don't have the ability to be so so pun in my in my explanation so that's is what I had for today guys um thank you very much Leo if you I don't know if you are there still there yes um so again thank you Leo for sharing all your expertise there with the audience um and thank you to our viewers for tuning in to the on.net live show as a reminder if you want to watch recordings like what like what you saw today on this stream you can do that by navigating to do.

[01:08:10]netlive in your browser and if you tune in to the show next week uh we'll be joined by guests jod donetti and the topic will be Fusion cache which is Jody's open- source project uh hope to see everyone then and thanks [Music] [Music] again [Music] y