--- title: "Introduction to OpenID Connect and OAuth" description: "This 1-day workshop shows developers, testers and architects how OAuth and OpenID Connect work: flows, scopes, claims and JWT tokens, with hands-on exercises." url: https://tn-data.se/courses/introduction-to-openid-connect-and-oauth/ type: workshop lang: en alternate: https://tn-data.se/sv/kurser/introduktion-till-openid-connect-och-oauth.md site: https://tn-data.se/ image: https://tn-data.se/_astro/21.aGSWFbJj_Z1pIgyQ.webp --- # Introduction to OpenID Connect and OAuth > Learn how OpenID Connect and OAuth work: flows, tokens, scopes and claims, at the protocol level. ## Workshop facts - **Duration:** 1 day - **Level:** Beginner - **Language:** English, Swedish OpenID Connect and OAuth are behind most logins and API access today, but they have many moving parts: flows, tokens, scopes, claims and a long list of specifications. In this one-day workshop you learn how they work at the HTTP level, so you can build secure identity solutions and find the problem when something goes wrong. The goal of this workshop is for you to learn how OAuth and OpenID Connect work at the protocol level. There is no programming, so you can join whatever language or platform you work with. Whichever OpenID Provider you use (Duende IdentityServer, Keycloak, Entra ID (Azure AD) or another), this workshop is for you. ### What You Will Learn - Authentication vs. authorization - How OAuth 2.x and OpenID Connect work - Fundamental concepts - How a client authenticates against an authorization server - How to retrieve and consume JWT tokens - How OpenID Connect fits into your architecture - How the tokens are secured and managed The workshop includes many hands-on exercises that show how the protocol works under the hood. After this workshop, I recommend the [Web Security Fundamentals](https://tn-data.se/courses/web-security-fundamentals/) workshop. Authentication builds on web security, so the two go well together. ### Who Is This Workshop For? Developers, testers and architects, new or experienced, who want to understand the fundamentals of application security with OAuth 2 and OpenID Connect. ### Prerequisites You should have a good understanding of: - The HTTP protocol, including methods, headers and cookies - How the web works in general - REST APIs and JSON - Some experience developing backend web solutions ### Workshop Agenda During the workshop, we cover the following topics. - Introduction - Authentication vs. Authorization - Our challenges - OAuth versions - OAuth vs. OpenID Connect - Token Service - Authorization Server - Relying party - Token types - Bearer token - Server implementations - Identity architecture - Service endpoints - The discovery document - Implicit flow - How does this flow work - Why it is no longer a recommended flow - JWT tokens - ID and access tokens - JSON Web Tokens - JWT access tokens - Claims and scopes - What are claims? - Claim types - Scopes - User consent - Securing the tokens - Unsecure tokens - Signed tokens - Signature algorithms - Private/public keys - Encrypted tokens - Authorization Code Flow - Public vs. private clients - Front vs. back-channel - Getting the tokens - Refresh tokens - One-time refresh tokens - Using the refresh token - Token introspection - Client Credentials flow - Proof Key for Code Exchange (PKCE) - State and Nonce - Single sign-on and sign-out - Backend for Frontend (BFF) - OAuth 2.1 ![Tore Nestenius presenting about authentication at the Copenhagen .NET User Group](https://tn-data.se/_astro/IMG_2248_png-768x576.C4OeCfT0_Z1smfct.webp) ## Why Learn OIDC and OAuth? As systems increasingly rely on OpenID Connect (OIDC) for authentication, developers, testers, and architects need a solid understanding of its core principles. Newcomers to OIDC often find it challenging, as it involves many moving parts, specifications, and concepts as shown below: ![Introduction to OpenID Connect and OAuth workshop](https://tn-data.se/_astro/OIDC-Maze-2.FeAC-3LV_1C2w0R.webp) Without a clear grasp of these fundamentals, implementations risk introducing security vulnerabilities. Real-world examples show the impact of such flaws: - [Critical vulnerabilities in JSON Web Token libraries](https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/) - [Severe Security Flaw Found in "jsonwebtoken" Library Used by 22,000+ Projects](https://thehackernews.com/2023/01/critical-security-flaw-found-in.html) - [Zero-day in Sign in with Apple](https://bhavukjain.com/blog/2020/05/30/zeroday-signin-with-apple/) - [Critical OAuth Flaws Uncovered in Grammarly, Vidio, and Bukalapak Platforms](https://thehackernews.com/2023/10/critical-oauth-flaws-uncovered-in.html) The **Introduction to OpenID Connect and OAuth** workshop gives you a solid starting point. Want to go deeper on your own? My video course [Getting Started: OpenID Connect](https://tn-data.se/courses/getting-started-openid-connect/) goes much further into the protocol. ## OIDC and OAuth Workshop FAQ Here are answers to frequently asked questions about this workshop. #### What are OAuth and OpenID Connect? OAuth is a standard that lets an application access an API on behalf of a user. OpenID Connect builds on OAuth and adds login, so the application also knows who the user is. For an introduction to the concepts, see my in-depth tutorial [OpenID Connect for Developers](https://tn-data.se/openid-connect/). #### Do I need to install any software on my computer? No, there’s no need to install any software. Each participant in this workshop will receive access to a Windows-based virtual machine, where all hands-on exercises will take place. You’ll only need to connect to this virtual machine via remote desktop, making it easy to participate without concerns about local restrictions on your computer or network. This setup allows me to create a consistent, ready-to-use environment for all participants. #### How can I test if I can connect to the virtual machine? If you'd like to verify your connection capabilities before the workshop, please contact me, and I’ll provide a test machine for you to try connecting to. Testing this in advance is recommended to ensure that your network allows outgoing remote desktop connections, so we don’t encounter any connectivity issues when the workshop starts. #### What if I have a Mac or Linux computer? If you're using a Mac or Linux computer, you’ll need to be familiar with connecting to a Windows-based virtual machine via remote desktop before the workshop. Here are some recommended resources to help you set up a remote desktop connection: - [Remmina](https://remmina.org/) – Linux remote desktop client. - [How to Use Remote Desktop in Linux or macOS to Connect to Windows 10](https://www.groovypost.com/howto/remote-desktop-linux-macos-windows-10/) - [Windows App](https://apps.apple.com/us/app/windows-app/id1295203466?mt=12) – Mac App Store Setting up ahead of time will ensure a smooth experience when connecting to the virtual machine during the workshop. Please note that I am unable to provide technical support for Mac or Linux setups. #### Is it made for a specific authorization server? No, this is a general workshop suitable for any OpenID Connect server, including [Duende IdentityServer](https://duendesoftware.com/), [Keycloak](https://www.keycloak.org/), or [Entra ID](https://www.microsoft.com/en-gb/security/business/identity-access/microsoft-entra-id/). The workshop focuses on OAuth and [OpenID Connect](https://openid.net/) principles, not a specific service. #### What do I need to do before the workshop? Send me any specific questions you'd like covered in the class. Be sure to read the welcome letter you’ll receive before the workshop. A large monitor is recommended so that you can view the exercise document (provided as a PDF) alongside the remote machine while doing the exercises. #### Is there any programming involved? No, this workshop does not require programming. The focus is on understanding OpenID Connect and OAuth concepts, without tying them to a specific platform, implementation, or language. ## What Is Included? When you take the Introduction to OpenID Connect and OAuth workshop, you get: - **Workshop Material:** I wrote the material myself and update it regularly to follow current practice. You get the presentation and the exercises as PDF, and on-site participants also get the exercises printed on paper. - **Hands-On Exercises:** You practise the core flows and protocols at the HTTP level, on a dedicated authorization server. - **Ongoing Support:** During and after the workshop, access a private chat for additional resources, questions, and updates. - **Live and Interactive Sessions:** Ask questions in real-time via chat or audio and get immediate clarifications. I also give live demonstrations. ![Tore Nestenius presenting an Introduction to OpenID Connect and OAuth](https://tn-data.se/_astro/Tore-in-Action-2-1024x719.BLedFzJj_2oNeQo.webp) ## Resources I frequently write about OpenID Connect and authentication on my blog. Some of the posts relevant to this workshop are: - [Demystifying OpenID Connect’s State and Nonce Parameters in ASP.NET Core](https://nestenius.se/net/demystifying-openid-connects-state-and-nonce-parameters-in-asp-net-core/) - [Debugging JwtBearer Claim Problems in ASP.NET Core](https://nestenius.se/net/debugging-jwtbearer-claim-problems-in-asp-net-core/) - [Debugging OpenID Connect Claim Problems in ASP.NET Core](https://nestenius.se/net/missing-openid-connect-claims-in-asp-net-core/) - [Debugging cookie problems in ASP.NET Core](https://nestenius.se/net/debugging-cookie-problems/) Additional core resources are: - [OpenID Connect for Developers](https://tn-data.se/openid-connect/) - [The OAuth 2.1 Authorization Framework](https://datatracker.ietf.org/doc/draft-ietf-oauth-v2-1/) - [OpenID Foundation](https://openid.net/) - [OpenID Connect Core 1.0 specification](https://openid.net/specs/openid-connect-core-1_0.html) ## After the Workshop Following the workshop, I offer ongoing support to help you apply what you’ve learned: - **OpenID Connect and OAuth Consulting**: Personalized guidance for integrating secure authentication and authorization in your projects. - **Duende IdentityServer Implementation**: Coaching, setup, configuration, and customization support tailored to teams using Duende IdentityServer. - **Architecture Review and Coaching:** Need an architecture review or focused coaching? I offer assessments and advice to optimize security and performance. - **Team Training & Workshops:** Custom sessions to strengthen your team’s understanding of OpenID Connect, OAuth, and essential security practices. ## About the Trainer My name is [Tore Nestenius](https://tn-data.se/about/). I teach on-site and remotely, both directly for companies and through training companies in Europe. What I bring: - I have trained developers since 2010 and taught several hundred courses and talks. - I create, maintain and teach every course myself, and improve it after every delivery. - I am a Microsoft .NET MVP. - I am the author of two video courses on [Dometrain](https://dometrain.com/author/tore-nestenius/), on authentication and authorization in .NET and on OpenID Connect. - I speak at conferences such as NDC, Øredev and Swetugg. - I co-founded [Edument](https://www.edument.se/), a Swedish training and consulting company, where I was CTO, developer and trainer. - I work as an [independent senior .NET consultant](https://tn-data.se/consulting/), so I teach from real projects. - I have worked as a developer for more than 25 years, and with .NET since it launched in 2002. - I co-founded the [.NET Skåne](https://www.meetup.com/net-skane/) user group. #### Follow me Connect with me on [**LinkedIn**](https://www.linkedin.com/in/torenestenius/) to stay updated on my latest blog posts, upcoming presentations, webinars, and more. ![Tore Nestenius, OpenID Connect and OAuth instructor](https://tn-data.se/_astro/Tore-in-action-1.6Zvr4mPb_10GDS1.webp) ### Training FAQs **Do you provide both on-site and remote training classes?** Yes, I provide both types of training. **Do you provide training in both Swedish and English?** Yes, both options are available. All my course materials are in English and I can teach the class in either Swedish or English. **Do you do half-day training?** When I run on-site, I usually do full-day classes. For remote training, I can provide options for both half and full days. **Do you do webinars and shorter talks?** Yes, please visit my [Talks](https://tn-data.se/talks/) page for more details. **Do you provide customized courses?** Yes, I do. [Contact me](https://tn-data.se/contact/) for more information. ## Related reading - [OpenID Connect and OAuth: What They Are and Where to Start](https://nestenius.se/openid-connect/) - [Demystifying OpenID Connect's State and Nonce Parameters in ASP.NET Core](https://nestenius.se/net/demystifying-openid-connects-state-and-nonce-parameters-in-asp-net-core/) - [Debugging OpenID Connect Claim Problems in ASP.NET Core](https://nestenius.se/net/missing-openid-connect-claims-in-asp-net-core/) - [Pushed Authorization Requests (PAR) in ASP.NET Core 9](https://nestenius.se/net/pushed-authorization-requests-par-in-asp-net-core-9/) To book this workshop or ask about it, see the [contact page](https://tn-data.se/contact/).