High Level Architecture
Summary: the User authorizes the App with the help of the AS to allow the App to call Backend functions on behalf of the User. These calls can be directed to our own backend services or to a 3rd party service. Note that the diagram does not show all possible calls just a high level overview. More details can be found on respective subpages: IAM for Native Apps, IAM for Microservices.
Note that the User can only give authorization based on the rights they already have. In other words, determining and administering User rights (e.g. via group membership or other means) is out of scope of this documentation. Also out of scope is how the policies are stored and how they are used to determine the authorization decision.
Jago Reference Architecture
This is the Jago reference architecture that is used as a basis for our design.
Roles
IAM covers only authentication & authorization via OAuth 2.0 which provides the following roles: Resource Owner, Client, Authorization Server, Resource Server. In our scenario, these roles are mapped to the following:
User: Resource Owner (when acting to authorize the app to execute requests on their behalf)
App (native mobile app): Client
AS: Authorization Server
MS, 3rd party service: Resource Server
Please note that these roles are defined in the context of IAM and be reused (or defined differently) in other contexts. Also note that the spec does NOT define the user agent role.
Client Authentication
According to best current practice: “Authorization servers SHOULD use client authentication if possible. It is RECOMMENDED to use asymmetric (public-key based) methods for client authentication such as mTLS or private_key_jwt [OpenID].”
Tokens
Token Lifetime, Scope Volume, Risk
Grant Types
There are four grant types supported by the spec:
Authorization Code (extended with PKCE later)
Implicit
Resource Owner Password Credentials
Client Credentials
According to best current practice:
“Clients SHOULD NOT use the implicit grant.”
“Public clients MUST use PKCE.”
“For confidential clients, the use of PKCE is RECOMMENDED.”
“The resource owner password credentials grant MUST NOT be used.”
So, the only two flows allowed are Authorization Code Grant with PKCE and Client Credentials.
References
OAuth Core
RFC 6749: The OAuth 2.0 Authorization Framework
RFC 6750: The OAuth 2.0 Authorization Framework: Bearer Token Usage
RFC 7636: Proof Key for Code Exchange by OAuth Public Clients (PKCE)
RFC 8705: OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens
Best Practices
RFC 6819: OAuth 2.0 Threat Model and Security Considerations
RFC 8252, BCP 212: OAuth 2.0 for Native Apps
IETF Draft: OAuth 2.0 Security Best Current Practice
Client Registration
RFC 7591: OAuth 2.0 Dynamic Client Registration
RFC 7592: OAuth 2.0 Dynamic Client Registration Management Protocol
JWT
RFC 7515: JSON Web Signature (JWS)
RFC 7516: JSON Web Encryption (JWE)
RFC 7519: JSON Web Token (JWT)
RFC 7523: JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants
RFC 7662: OAuth 2.0 Token Introspection
RFC 7800: Proof-of-Possession Key Semantics for JSON Web Tokens (JWTs)
RFC 8725: JSON Web Token Best Current Practices
IETF Draft: JWT Response for OAuth Token Introspection
Token Exchange
Attachments:
Screenshot 2022-05-09 at 16.31.36.png (image/png)
~drawio~6203b4b4e5caff0070e2aa9c~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~drawio~6203b4b4e5caff0070e2aa9c~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~drawio~6203b4b4e5caff0070e2aa9c~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~drawio~6203b4b4e5caff0070e2aa9c~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~drawio~6203b4b4e5caff0070e2aa9c~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~drawio~6203b4b4e5caff0070e2aa9c~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~drawio~6203b4b4e5caff0070e2aa9c~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~drawio~6203b4b4e5caff0070e2aa9c~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~drawio~6203b4b4e5caff0070e2aa9c~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~drawio~6203b4b4e5caff0070e2aa9c~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~drawio~6203b4b4e5caff0070e2aa9c~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~drawio~6203b4b4e5caff0070e2aa9c~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~drawio~6203b4b4e5caff0070e2aa9c~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~drawio~6203b4b4e5caff0070e2aa9c~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~drawio~6203b4b4e5caff0070e2aa9c~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~drawio~6203b4b4e5caff0070e2aa9c~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~drawio~6203b4b4e5caff0070e2aa9c~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~drawio~6203b4b4e5caff0070e2aa9c~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~drawio~6203b4b4e5caff0070e2aa9c~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~drawio~6203b4b4e5caff0070e2aa9c~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~drawio~6203b4b4e5caff0070e2aa9c~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~drawio~6203b4b4e5caff0070e2aa9c~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~drawio~6203b4b4e5caff0070e2aa9c~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~drawio~6203b4b4e5caff0070e2aa9c~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~drawio~6203b4b4e5caff0070e2aa9c~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~drawio~6203b4b4e5caff0070e2aa9c~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~drawio~6203b4b4e5caff0070e2aa9c~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~drawio~6203b4b4e5caff0070e2aa9c~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~drawio~6203b4b4e5caff0070e2aa9c~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~drawio~6203b4b4e5caff0070e2aa9c~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~drawio~6203b4b4e5caff0070e2aa9c~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~drawio~6203b4b4e5caff0070e2aa9c~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~drawio~6203b4b4e5caff0070e2aa9c~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~drawio~6203b4b4e5caff0070e2aa9c~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~drawio~6203b4b4e5caff0070e2aa9c~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~drawio~6203b4b4e5caff0070e2aa9c~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~drawio~6203b4b4e5caff0070e2aa9c~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~drawio~6203b4b4e5caff0070e2aa9c~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~drawio~6203b4b4e5caff0070e2aa9c~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~drawio~6203b4b4e5caff0070e2aa9c~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~drawio~6203b4b4e5caff0070e2aa9c~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~drawio~6203b4b4e5caff0070e2aa9c~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~drawio~6203b4b4e5caff0070e2aa9c~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~drawio~6203b4b4e5caff0070e2aa9c~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~drawio~6203b4b4e5caff0070e2aa9c~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
Untitled Diagram.drawio (application/vnd.jgraph.mxfile)
Untitled Diagram.drawio.png (image/png)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
Untitled Diagram.drawio (application/vnd.jgraph.mxfile)
Untitled Diagram.drawio.png (image/png)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
Untitled Diagram.drawio (application/vnd.jgraph.mxfile)
Untitled Diagram.drawio.png (image/png)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
Untitled Diagram.drawio (application/vnd.jgraph.mxfile)
Untitled Diagram.drawio.png (image/png)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
Untitled Diagram.drawio (application/vnd.jgraph.mxfile)
Untitled Diagram.drawio.png (image/png)
PNG image-995E80AA9F36-1.png (image/png)
PNG image-7BAC36FBDE72-1.png (image/png)
PNG image-07419FFD950F-1.png (image/png)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
Untitled Diagram.drawio (application/vnd.jgraph.mxfile)
Untitled Diagram.drawio.png (image/png)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
Untitled Diagram.drawio (application/vnd.jgraph.mxfile)
Untitled Diagram.drawio.png (image/png)
PNG image-0104C04E376E-1.png (image/png)
Overview Security Architecture.drawio (application/vnd.jgraph.mxfile)
Overview Security Architecture.drawio.png (image/png)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
Untitled Diagram.drawio (application/vnd.jgraph.mxfile)
Untitled Diagram.drawio.png (image/png)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
Untitled Diagram.drawio (application/vnd.jgraph.mxfile)
Untitled Diagram.drawio.png (image/png)
~Overview Security Architecture.drawio.tmp (application/vnd.jgraph.mxfile)
~Overview Security Architecture.drawio.tmp (application/vnd.jgraph.mxfile)
Overview Security Architecture.drawio (application/vnd.jgraph.mxfile)
Overview Security Architecture.drawio.png (image/png)
~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)
Untitled Diagram.drawio (application/vnd.jgraph.mxfile)
Untitled Diagram.drawio.png (image/png)
~Overview Security Architecture.drawio.tmp (application/vnd.jgraph.mxfile)
~Overview Security Architecture.drawio.tmp (application/vnd.jgraph.mxfile)
~Overview Security Architecture.drawio.tmp (application/vnd.jgraph.mxfile)
~Overview Security Architecture.drawio.tmp (application/vnd.jgraph.mxfile)
Overview Security Architecture.drawio (application/vnd.jgraph.mxfile)
Overview Security Architecture.drawio.png (image/png)
PNG image-627872061988-1.png (image/png)
PNG image-ED25030F17E6-1.png (image/png)
