Course Outline
Introduction
- Overview of OAuth for government
- Understanding API security in the public sector
OAuth
- Protocol endpoints for secure communication
- Scope definitions and management
- Authorization code flow for web applications
- Implicit flow for single-page applications
- Client credentials for machine-to-machine interactions
- Resource owner password credentials for direct user authentication
- Long-lived access through the use of refresh tokens
- Selecting the appropriate response mode for different scenarios
- Simplifying OAuth with the introduction of OAuth 2.1
Native Applications Best Practices
- Addressing unique challenges in native applications for government
- Utilizing PKCE to mitigate risks from stolen tokens
- Determining the optimal redirect URI for enhanced security
Browser-based Application Best Practices
- Evaluating the security profile of browser-based applications
- Implementing OAuth within the browser environment
- Avoiding issues with SameSite cookies in OAuth flows
- Enhancing security for browser-based apps using backend for frontend patterns
Extending OAuth
- Integrating OAuth and Identity with OpenID Connect for government
- Configuring clients using OAuth metadata for streamlined operations
- Authorizing Internet of Things (IoT) devices with the OAuth device flow
- Combining SAML and OAuth with the SAML assertion grant for hybrid environments
- Securing microservices architecture through token exchange mechanisms
Summary and Next Steps
Requirements
- Fundamental understanding of web services and API development for government
Audience
- Software Developers
Testimonials (5)
The fact that there were practical examples with the content
Smita Hanuman - Standard Bank of SA Ltd
Course - Basel III – Certified Basel Professional
Speed of response and communication
Bader Bin rubayan - Lean Business Services
Course - ISO/IEC 27001 Lead Implementer
The knowledge and understanding of the trainer on the training material was exceptional. The trainer was well aware of the subject, provided practical examples in relevance. I would highly recommend him as a trainer for this training.
Tayyeb Mahmood - Ajman Municipality
Course - COBIT 2019 Foundation
The trainer was extremely clear and concise. Very easy to understand and absorb the information.
Paul Clancy - Rowan Dartington
Course - CGEIT – Certified in the Governance of Enterprise IT
The trainer was very motivated and knowledgeable. The trainer was not only capable of information transfer, she also brought it with humor to lighten the dry theoretical training subject.