Chapter 10: Enterprise Security, OAuth2, OIDC & Cryptography Architecture

1. Concept Introduction

From Monolithic Sessions to Delegated Federated Identity

In early web applications, identity relied on Monolithic Stateful Sessions (`JSESSIONID`, `PHPSESSID`). As microservices and mobile apps proliferated, stateful sessions collapsed under credential sharing, session DB bottlenecks, and CSRF vulnerabilities.

+-------------------------------------------------------------------------+
|                  DELEGATED FEDERATED IDENTITY (OIDC/OAUTH2)             |
|  [ User ] ──(1. Auth)──> [ Authorization Server (Okta/Keycloak) ]       |
|                                       │ (2. Issues Tokens)              |
|                                       ▼                                 |
|  [ Microservice B ] <──(3. Bearer JWT)── [ Client App / SPA / Mobile ]  |
+-------------------------------------------------------------------------+

2. Theory & Low-Level Internals

A. Authorization Code Flow with PKCE (RFC 7636)

Code_Challenge = BASE64URL-ENCODE(SHA-256(Code_Verifier))

B. Cryptographic Mechanics: Symmetric (HS256) vs Asymmetric (RS256/ES256)

ASYMMETRIC SIGNING (RSA-4096, ECDSA P-256, Ed25519)
Private Key K_priv (AS) ──> Sign Token ──> Signature Header.Payload.Sig
Public Key  K_pub  (RS) ──> Verify Signature ──> Valid / Invalid (JWKS)

3. Real Production Architecture Example

Enterprise Zero-Trust Security Mesh with API Gateway Ingress JWT validation, SPIFFE/SPIRE mTLS client attestation, and Open Policy Agent (OPA) sidecars evaluating Rego ABAC policies.

4. Code Examples

A. Production Pattern: Cryptographic JWT Validator with PyJWKClient

import jwt
from jwt import PyJWKClient
from fastapi import FastAPI, Depends, HTTPException, status
from fastapi.security import HTTPBearer

OIDC_ISSUER = "https://auth.enterprise.internal/auth/realms/production"
API_AUDIENCE = "https://api.enterprise.internal/v2"
JWKS_URL = f"{OIDC_ISSUER}/protocol/openid-connect/certs"

jwks_client = PyJWKClient(JWKS_URL, cache_keys=True, cache_jwk_set=True, lifespan=3600)
security = HTTPBearer()

async def validate_jwt_token(credentials=Depends(security)):
    token = credentials.credentials
    try:
        signing_key = jwks_client.get_signing_key_from_jwt(token)
        payload = jwt.decode(
            token, signing_key.key, algorithms=["RS256"],
            audience=API_AUDIENCE, issuer=OIDC_ISSUER,
            options={"verify_signature": True, "verify_exp": True}
        )
        return payload
    except jwt.PyJWTError as e:
        raise HTTPException(status_code=401, detail=str(e))

5. Tiered Interview Questions

6. Production Debugging Scenario