TN-Data

Getting Started: OpenID Connect

My on-demand video course on Dometrain. It explains how OAuth 2 and OpenID Connect work at the protocol level, whatever language you write your code in.

Back to Workshops

Who Is This Course For?

For any developer who works with OpenID Connect, whether you use .NET, Java, Node.js or something else. The course is about the protocols, so it is not tied to one framework or library.

The first chapter sets up Fiddler and HTTPS, so you can watch the traffic between the client, the OpenID Provider and the resource. You watch it on Dometrain, at your own pace.

What the Course Covers

The aim is to see what goes on inside OAuth 2 and OpenID Connect, so they stop being a black box. You set up a local environment with Fiddler and OpenSSL and watch the flows live. From there I cover the OpenID Provider, why the Implicit Flow was deprecated, opaque tokens and JWTs, ID tokens versus access tokens, and claims, scopes and the UserInfo endpoint.

The second half is about cryptography: signing tokens with symmetric and asymmetric algorithms (RSA and elliptic curve), distributing and rotating keys, and validating signatures. Then the Authorization Code Flow and refresh tokens, and how state, nonce, at_hash and PKCE protect the flows. The course ends with single sign-on, sign-out, token revocation, the Client Credentials Flow, and OAuth 2.1 and current best practices.

Course Agenda

  1. Course OverviewWelcome; What You Will Learn; Who is the course for and prerequisites
  2. Getting StartedCourse Material; Installing Fiddler; Fiddler and HTTPS; Development Environment and HTTP Files; OpenSSL; The Demo Application; The Demo Environment
  3. Introduction to OAuthThe Need for OAuth; Delegated Access; Introducing OAuth 2; Introducing OpenID Connect; OAuth Dance
  4. OpenID ProviderThe Need for an OpenID Provider; OpenID Provider Implementations; Federated Authentication; Exploring the OpenID Provider
  5. Implicit FlowOAuth and OpenID Connect Flows; Browser-based Applications; Backend-based Applications; Why the Implicit Flow Was Deprecated
  6. TokensToken Introspection; Opaque Tokens; JSON Web Token; ID Token; Access Token
  7. Claims and ScopesClaims; Scopes; UserInfo Endpoint; Advanced Scopes and Claims
  8. Signing the TokensSecuring JWT Tokens; Unsecured Tokens; Signed Tokens; Symmetric Signed Tokens; Asymmetric Signed Tokens; RSA Signed Tokens; Elliptic Curve Signed Tokens
  9. Token ValidationKey Distribution; Key Rotation; Signature Validation; Claims Validation
  10. Authorization Code FlowIntroducing the Flow; From Code to Tokens; Introducing Refresh Tokens; Using Refresh Tokens; Observing OpenID Connect
  11. Securing the FlowsThe State Parameter; Advanced Uses of State; Trusting the Tokens with Nonce and at_hash; The need for PKCE; PKCE Explained
  12. Single Sign-On and Sign-OutSingle Sign-On; Sign-Out; The Sign-Out Flow; Token Revocation
  13. Client Credentials FlowIntroducing the Flow; Calling APIs; Comparing the Flows
  14. Course ConclusionOAuth 2.1 and Best Current Practices; OAuth and OpenID Connect Summary; Conclusion and Next Steps

Watch on Dometrain

Training for Your Team

Want a one-day introduction for your team instead? See my workshop Introduction to OpenID Connect and OAuth.

Get in touch

Contact