Download as PDF, PPTX
Uploaded byWSO2
[APIdays INTERFACE 2021] Authentication and Authorization Best Practices for your API in 2021
The document outlines best practices for API authentication and authorization in 2021, emphasizing the need for strong security measures due to a significant increase in data breaches. It covers the importance of protecting APIs using OAuth 2.0 flows, multi-factor authentication, and dynamic authentication methods to enhance user security. The document also highlights the role of authorization in limiting access to resources and implementing fine-grained access controls.
[APIdays INTERFACE 2021] Authentication and Authorization Best Practices for your API in 2021
- 1. Authentication and AuthorizationBest Practices for Your API in 2021 June 16, 2021 isharak@wso2.com Director of Engineering, IAM @ WSO2 Ishara Karunarathna
- 2. 2 The Agenda ● High-levelAPI security architecture ● Authentication and authorization for API access ● Implementing authentication and authorization best practices ○ Demo using WSO2 Identity Server
- 3.
- 4. 25,000-Foot View ofAPI Security Architecture 4
- 5. Closer View ofAPI Security Architecture 5
- 6. Recommended OAuth 2.0Flows for API Access 6 Grant Type Web App Native App SPA Services Device Authorization Code X Authorization Code with PKCE X X Client Credentials X X Implicit Flow X* Password Grant X* Device Authorization Grant X JWT and SAML Grant (RFC7523) X OAuth MTLS (RFC8705) X X Token Exchange (RFC8693) X X
- 7. Authentication and Authorizationfor API Access
- 8. 8 Over 8.4B records exposed duringthe first quarter of 2020 Whopping 273% increase compared to Q1 2019 Approximately 70% due to unauthorized access to systems or services Due to the COVID-19 pandemic, millions of employees around the world switched to remote working, and many businesses were forced to adopt digitalization within a short time frame. Attackers thrived during this period because companies skipped some of the long-held security practices in the rush to adopt the new normal. 2020 2020 Q1 Data Breach QuickView Report - Risk Based Security
- 9. 9 IAM should notbe the weakest link in the system
- 10. End-User Identity Management Digitalidentities can be everywhere. Managing them is a primary concern. ● Different user Stores ● Different user types ● Different user schemas ● Different user management workflows 10
- 11. 11 Authentication Verifying that aperson is who they say they are.
- 12. Authentication ‘Passwords’ are NotSecure! ● Around 60% of people reuse passwords across multiple sites regularly. ● 13% of people use the same password for all accounts and devices. ● 48% of workers use the same password in both their personal and work accounts. ● 80% of data breaches in 2019 were caused by password compromise. Authentication must be a focal point when protecting your APIs. 12
- 13. Strong Authentication Authenticating usersby challenging them with multiple authentication factors, e.g., password, SMS, and fingerprint. ● Multi-factor authentication (MFA) ⦿ Knowledge ⦾ Something you know ⦾ Password, pin, secret ⦿ Possession ⦾ Something you have ⦾ Phone, token, badge, smart card ⦿ Inherence ⦾ Something you are ⦾ Fingerprint, facial feature, voice
- 14. 14 User is notstatic, so is their authentication ● Authentication needs to be more dynamic and responsive ● Context sensitivity is important ● Security is key, but it should be balanced with convenience
- 15. Adaptive Authentication ● Provideshigh security without impacting usability. ● Select the right authentication factors depending on a user’s risk profile and tendencies. 15
- 16.
- 17. Federated API Access 17 Attractdeveloper community Acquisitions and mergers Hassle-free API access
- 18.
- 19.
- 20.
- 21. 21 Authorization Verifying whether theuser is permitted to access a specific resource or function.
- 22. Authorization ● OAuth 2.0scopes limit an application's access to a user's resources. ● Authorization server-level and resource-level scope validation. Upcoming, ● Rich Authorization Requests (draft) ● Incremental Authorization (draft) 22
- 23. Fine-grained Scope Validation Ruleand Policy-Based scope validation: ● XACML ● Open Policy Agent (OPA) 23
- 24.
- 25.