Cloud Native Data Security with OAuth

Table of contents

1. Brief Table of Contents (Not Yet Final)
2. I. Introducing Cloud Native OAuth
3. 1. Why Do You Need OAuth?
   1. API-First Security
   2. What is OAuth 2.0?
   3. Zero-Trust Security
      1. APIs with Perimeter Security
      2. APIs with Infrastructure Security
      3. APIs with Token-Based Security
      4. Zero-Trust for Clients
      5. Zero-Trust for Users
   4. API Supporting Components
   5. Cloud Native Platforms
   6. Summary
4. 2. OAuth 2.0 Distilled
   1. Roles
   2. The Abstract Flow
   3. The Access Token
   4. Client Capabilities
      1. Public and Confidential Clients
      2. The Code Flow
      3. Client Credentials Flow
      4. Refresh Token Flow
      5. Outdated Flows
   5. OpenID Connect
      1. The Hybrid Flow
      2. User Info
   6. OAuth Evolution
   7. Sessions and Lifecycle
      1. The Revoke Flow
      2. Terminating SSO
   8. Summary
5. 3. Security Architecture
   1. What is an API Security Architecture?
   2. Functions in the API Security Architecture
      1. Identity Management
      2. API Management
      3. Entitlement Management
   3. The Role of the Client
   4. The Role of the Access Token
   5. What Security Components do you Need?
   6. The Role of the Authorization Server
   7. The Role of the API Gateway
   8. The Role of the Policy Engine
   9. API Responsibilities
   10. Client Responsibilities
   11. Operating Security Components
   12. Summary
6. 4. OAuth Data Design
   1. Authorization Server Data
   2. OAuth Configuration Settings
   3. Designing User Accounts
      1. Personal Data
      2. Business User Attributes
      3. API User Identities
      4. Identity Operations
   4. User Management APIs
   5. Multi-Region
   6. Multi-Tenancy
   7. User Migration Code Example
   8. Summary
7. 5. Secure API Development
   1. Unified API Security with JWT Access Tokens
   2. Validating JWT Access Tokens
      1. JSON Web Keys
      2. Rotating Token Signing Keys
      3. JWT Standard Claims
      4. JWT Validation Best Practices
      5. JWT Validation Code
   3. API Authorization Logic
      1. Use Scopes for Coarse-Grained Authorization
      2. Use Claims for Fine Grained Authorization
      3. Design for Flexibility
   4. Handling Token Expiry in APIs
   5. Testing Zero-Trust APIs
   6. API Code Example
   7. Summary
8. II. Securing APIs with Tokens
9. 6. Access Token Design
   1. The Access Token Content is a Contract
      1. The Contract is Not a Secret
      2. Altering the Contract
   2. Understanding Token Scope
      1. OpenID Connect Scopes
   3. Understanding Claims
      1. What Constitutes a Good Claim?
      2. Relation of Claims to Scopes
      3. The Audience Claim
      4. Data Sources For Claims
   4. Obtaining the User’s Consent
   5. Managing Access Tokens at Scale
      1. Scaling Scopes
      2. Scaling Claims
   6. Designing Tokens Shared Across Multiple APIs
      1. Token Exchange
      2. Embedding Tokens in Tokens
      3. Designing Tokens For Asynchronous Communication
   7. Summary
10. About the Authors