Kellton Tech Solutions, Inc.

Presented By: Siva Subrahmanyam Sr. Integration Consultant

API Security : Using OAuth2 Framework

Our Values:

• Incorporated

• New management takes over led by Niranjan Chintam and Krishna Chintam

• $ 10 MN • Acquired and merged Tekriti Software Private Limited, a software services

company focusing on web/open source • Acquired SKAN DbyDx Software Private Limited, a mobility solutions company

• $ 40 MN • Acquired Supremesoft Global Inc., and eVantage Solutions Inc., US based IT

consulting companies • Acquired Vivos Professional Services LLC, a USA based focusing on life-

sciences & healthcare space • 21st in Deloitte Technology fast 50 India 2014 • Selected among the ’20 Most Promising Travel & Hospitality Solution

Providers’ and ‘Top 20 Enterprise Mobility Companies in India by CIO Review

• $ 100 MN Run Rate. • Acquired ProSoft Technology Group Inc., a US based ERP, EAI Solutions

company. • KLGAME was nominated in the finals of HYSEA Annual Summit and Awards

2015. • Acquired Bokanyi Group, leading US based cloud and analytics service

provider.

Our Mission:

Our Vision: Offering infinite possibilities with technology

To be “the trusted partner” of our clients

Innovation

Ownership

Trust

Speed Meritocracy

Accountability

Customer Centricity

Milestones:

FY 1993

FY 2009

FY 2013

FY 2015

FY 2017

About Kellton Tech

Infinite Possibilities with Technology

Thought Leaders in Technology Adoption:

As an early entrant in IoT and SMAC, we provide innovative transformation solutions to the clients leveraging cloud ERP solutions, digital business platforms, and digital systems integration

Focused on Design Thinking:

We understand the importance of digital customer experience and operational excellence and explore infinite possibilities with the technology to deliver desired business outcomes.

Disciplined and Experienced Team: We hire the best talent, leverage the best practices from design, development and implementation of systems of record, differentiation, engagement and insight.

We Are: We Do:

Digital Transformation BU

Digital Connected Enterprise BU

Enterprise Solutions (SAP) BU

Systems of Engagement New apps built leveraging design thinking that provide next competitive advantage now and in the future.

Systems of Differentiation Business Processes and Orchestration layers that provide competitive advantage.

Systems of Record Standardized functions and processes across the organisation that provide predictability, consistency and optimization.

KLGAMETM

Who we are

Millions: Software we have developed is being used by millions of people worldwide.

600: We have partnered with more than 600 innovative clients (39 Fortune 1000) in Healthcare, Retail, Insurance, Media, Software and Technology industries.

2 Million: We perform more than 2 Million hours of engineering work for our clients every year.

1100+ People: Headquartered in Princeton, NJ we have global delivery centers across US, UK, and India

Our Numbers

Partial Customers by Industry

Others

Financials Services

Energy Utilities

Manufacturing

Retail

Digital Transformation and Enterprise Architecture Strategy – Advisory Services

API / SOA / ESB Core Application Integration – API/SOA Strategy, Governance and COE

BPM Solutions with Business Workflows, Rules, Analytics and Dashboards

Distributed In-Memory Data Solutions for High Throughput and Low Latency Applications

Real-time and Streaming Analytics Solutions in IoT and Big Data Applications

SaaS Integration, Cloud Enablement and Hybrid Infrastructure Services

Infrastructure Modernization, Continuous Integration / Dev-Ops Services and AMS

Core Services Portfolio

Technology Partnerships

Core Technology Expertise

Anypoint Platform

Industry Solutions and Domain Expertise

Banking and Finance Treasury Services – Payment and Forex

Gateways SWIFT Integration Business Process modeling and Optimization in

o Loan Origination o Account Opening o Risk and Regulatory

Transportation and Logistics Fleet Management and Real-time On-Board

Application services B2B and Vendor Managed Inventory Solutions

Retail and Manufacturing ERP Integration Omni Channel Services Architecture PoS and eCommerce Integration

Energy and Utilities Energy Trading and Power Scheduling RTO Integration and Market Participation Smart Grid Integration and enablement

API - Introduction

• API, API Strategy, API Economy etc.

API Security Fundamentals.

• HTTP Basic Authentication

• Digest access Authentication, etc.

• Token based Authentication

OAuth2.0 Framework – Deep Dive

OAuth1.0a versus Oauth2.0 – Differences.

OAuth2.0 Framework - Pros and Cons.

Software AG webMethods – OAuth2.0 Demo

Q & A

Upcoming Webinars

Today’s Agenda

API - Introduction

API Security

Versioning

Status Codes

JSON

Authentication &

Authorization

Paginate

Rate Limiting

Caching

Documentation

API Security Fundamentals

HTTP Security Mechanisms: Basic Authentication: Client: basic-credentials = "Basic" SP basic-cookie basic-cookie = base64encode(username+":"+password) Cons:

• Attacker can obtain user's plain text password • The username and password are sent with every request • The server must know user's password in plain text • If intercepted, requests can be reproduced on the future • Vulnerable to Man-in-the-middle Attacks.

API Security Fundamentals, Contd...

Digestive Authentication: The client sends a hashed form of the password to the server. Although, the password cannot be captured over HTTP, it may be possible to replay requests using the hashed password. HA1=MD5(username:realm:password) HA2=MD5(method:digestURI) response=MD5(HA1:nonce:HA2) Cons:

• Vulnerable to Man-In-The-Middle attacks in some cases. • Many of the security options are optional, which makes it less secure. • Difficult to design and implement. • Limitations when working with certain cryptic modules such as FIPS.

API Security Fundamentals, Contd...

Token Based Authentication: What is a • Token • Bearer Token • Holder-Of-Key Token (HOK) Using a bearer token does not require a bearer to prove possession of cryptographic key material (proof-of-possession), whereas, HOK does. Advantages: • Extra security • Stateless and scalable servers • Pass authentication to other applications (Delegated Access) • Fine-grained access control (Scopes) • Expiry & Revoke Access

OAuth2.0 Framework – Deep Dive

OAuth Stands for Open Authorization (Token based authorization scheme) Facilitates Delegated Authorization. The OAuth 2.0 authorization framework enables a third-party application to obtain limited access to an HTTP service, either on behalf of a resource owner by orchestrating an approval interaction between the resource owner and the HTTP service, or by allowing the third-party application to obtain access on its own behalf.

OAuth2.0 Framework – Deep Dive, Contd…

OAuth Roles: Resource Owner: An entity capable of granting access to a protected resource. When the resource owner is a person, it is referred to as an end-user. Resource Server: The server hosting the protected resources, capable of accepting and responding to protected resource requests using access tokens. Client: An application making protected resource requests on behalf of the resource owner and with its authorization. Authorization Server: The server issuing access tokens to the client after successfully authenticating the resource owner and obtaining authorization.

OAuth2.0 Framework – Deep Dive, Contd…

User / Resource Owner Browser / Client App Resource Server

Auth Server

1. User uses his app 2. Client Requests Authorization for User

2. Authorization request redirected to Resource Owner by Authorization Server

3. Resource Owner Grants Authorization by logging into Server & And Approving Authorization Request.

4. Authorization Server sends Authorization Code

5. Client passes Auth Code and Requests for Access token

6. Authorization Server sends Access Token & Refresh token

7. Client passes Access token and invokes Rest API

OAu

th2.

0 W

orkf

low

8. Protected Data / resource is sent by Resource Server API

OAuth2.0 Framework – Deep Dive, Contd…

User / Resource Owner Browser / Client App Resource Server

Auth Server

5. Client passes Expired Access token

6. Resource Server sends Invalid Token Error

7. Client passes Refresh token to Authorization Server

OAu

th2.

0 W

orkf

low

Re

fres

hing

Acc

ess T

oken

8. Resource Server sends New Access Token & Optional Refresh token

9. Client passes Access token and invokes Rest API

10. Protected Data / resource is sent by Resource Server API

OAuth2.0 Grant Types

OAuth2.0 Framework provides different options by various Grant Types such as,

• Authorization code grant o Used for Confidential Clients such as server based clients.

• Implicit Grant o Used for Public Clients such as browser based clients.

• Resource owner credentials grant o Used when Client has access to User’s credentials.

• Client credentials grant. o Used when the registered client wants to obtain token for itself.

• Refresh token grant. o Used to refresh expired access tokens, by passing refresh tokens.

OAuth1.0a versus OAuth2.0 Differences

S.No. OAuth1.0a OAuth2.0

1 Doesn’t need HTTPS Communication. Demands HTTPS Communication

2 Requires Digital Signatures to sign OAuth request messages

Doesn’t need Digital Signatures and relies on SSL/TLS.

3 Client app signs all OAuth requests to Auth Server with its unique “consumer secret.”

Client application includes “client secret” with every request.

2 More Secure because of the Digital signatures for OAuth Communication as well.

Relatively Less Secure than OAuth1.0a, as they are centered around bearer tokens.

3 Less Flexible & More Complex to Design and Develop.

Easier for 3rd Party Developers to Implement.

5 OAuth 1.0 only handled web browser based implementations.

OAuth 2.0 considers non-web clients as well.

OAuth2.0 Framework - Pros and Cons

OAuth2.0 Advantages: 1. Various roles defined in this framework allows better separation of duties. Eg: Handling resource requests

and handling user authorization can be decoupled in OAuth 2.0. 2. Provided for greater flexibility and options by various Grant Types. 3. It lets users choose the actions the calling application can access. This serves as a limit to what third parties

can do with user information. 4. Concept of Refresh tokens was introduced. 5. Easy for 3rd party clients to develop and design. 6. Supports non-browser Implementations, and hence more widely used by all major companies. OAuth2.0 Disadvantages: 1. Bearer tokens Centric., makes it relatively less secure than OAuth1.0 2. Not backward compatible with OAuth1.0

Demo

Walk through of the

o OAuth2.0 Configuration in SoftwareAG webMethods Integration Server. o OAuth2.0 Authorization work flow using Browser & SOAP UI Clients. o OAuth2.0 Implementation – Server Client & Resource Server Code.

Kellton Tech Solutions Inc. 3 Independence Way, Princeton, NJ 08540

Demo OAuth Support in Software AG webMethods: Built-in Services: 1. pub.oauth:authorize Initiates an authorization request from a client application to the authorization server. 2. pub.oauth:getAccessToken Requests an access token from the authorization server. 3. pub.oauth:refreshAccessToken Requests a fresh token from the authorization server. 4. pub.client.oauth:executeRequest To access protected resources on a resource server using an existing Open

Authentication (OAuth) access token

Kellton Tech Solutions Inc. 3 Independence Way, Princeton, NJ 08540

Kellton Tech Solutions Inc. 3 Independence Way, Princeton, NJ 08540

Upcoming Webinars

Kellton Tech Solutions Inc. 3 Independence Way, Princeton, NJ 08540

Date Topic Presenter

31st Jan 2017 Software AG Integration Cloud Ankit Malhotra