A passwordless future! Passkeys for Spring Developers

1. A Passwordless Future! Passkeys and WebAuthn for Java developers Deepu K Sasidharan
2. @oktaDev | @deepu105 | deepu.tech ➔ JHipster co-chair ➔ Java Champion ➔ Creator of KDash, JDL Studio, JWT UI ➔ OSS aficionado, polyglot dev, author, speaker ➔ Developer Advocate @ Okta Hi, I’m Deepu K Sasidharan @deepu105@mastodon.social deepu.tech @deepu105 deepu05
3. @oktaDev | @deepu105 | deepu.tech Why passwordless?
4. @oktaDev | @deepu105 | deepu.tech The password problem
5. @oktaDev | @deepu105 | deepu.tech The human problem
6. @oktaDev | @deepu105 | deepu.tech Phishing Knowledge-based Remote replay Data breach Reuse & share Password management
7. @oktaDev | @deepu105 | deepu.tech Passwordless Biometric Magic links OTPs Push notifications
8. @oktaDev | @deepu105 | deepu.tech Passwordless future == Passkeys
9. @oktaDev | @deepu105 | deepu.tech Public-key cryptography Pair of mathematically linked keys
10. @oktaDev | @deepu105 | deepu.tech
11. @oktaDev | @deepu105 | deepu.tech
12. @oktaDev | @deepu105 | deepu.tech Authenticator Can create and store public-private key pairs
13. @oktaDev | @deepu105 | deepu.tech Roaming authenticators Removable device via USB, NFC, Bluetooth • Yubikey • Google Titan • Smartphones Platform authenticators Built into the device • TouchID • FaceID • Smartphone authenticators • Windows Hello
14. @oktaDev | @deepu105 | deepu.tech == Authentication standard Based on public key cryptography. FIDO
15. @oktaDev | @deepu105 | deepu.tech FIDO2 WebAuthentication (WebAuthn) Client to Authenticator Protocol (CTAP)
16. @oktaDev | @deepu105 | deepu.tech == W3C standard WebAuthn is the standard that allows for passkeys implementation WebAuthn
17. @oktaDev | @deepu105 | deepu.tech Illustration based on https://webauthn.me/introduction
18. @oktaDev | @deepu105 | deepu.tech Client to Authenticator Protocol Communicate with authenticators over USB, NFC, and Bluetooth
19. @oktaDev | @deepu105 | deepu.tech
20. @oktaDev | @deepu105 | deepu.tech == Discoverable passwordless FIDO credentials It uses asymmetric public key cryptography Passkeys
21. @oktaDev | @deepu105 | deepu.tech Passkeys Synced Device-bound • Private key synced between devices in same ecosystem and backed up to cloud • Better usability • One time enrollment • Can be restored on device loss or on new device • Less secure than device-bound passkeys • Private key stored only on the device • Not as convenient as synced passkeys • Each device needs enrollment • No recovery or backups • Most secure option
22. @oktaDev | @deepu105 | deepu.tech How does the magic happen?
23. @oktaDev | @deepu105 | deepu.tech Registration flow
24. @oktaDev | @deepu105 | deepu.tech Authentication flow
25. @oktaDev | @deepu105 | deepu.tech Why passkeys?
26. @oktaDev | @deepu105 | deepu.tech Phishing Knowledge-based Remote replay Data breach Reuse & share Password management
27. @oktaDev | @deepu105 | deepu.tech Easier to maintain Not reusable & shareable* Breach resistant Remote attack resistant Phishing resistant Discoverable
28. @oktaDev | @deepu105 | deepu.tech Passkeys security and usability spectrum
29. @oktaDev | @deepu105 | deepu.tech menti.com Code: 7175 4535
30. @oktaDev | @deepu105 | deepu.tech Challenges
31. @oktaDev | @deepu105 | deepu.tech • OS/Browser support • Cloud vendor reliance • Enterprise use cases • Reset & recovery
32. @oktaDev | @deepu105 | deepu.tech Passkeys in Spring Boot web app using an IdP Auth0 by Okta as IdP
33. @oktaDev | @deepu105 | deepu.tech # Create a Spring Boot web app $ curl -G https://start.spring.io/starter.tgz \ -d dependencies=web,okta -d baseDir=passkey-demo | tar -xzvf - # Add controller for @GetMapping("/") # Create an Auth0 account and configure tenant to enable passkeys # Login to the tenant $ auth0 login # Create an Auth0 app $ auth0 apps create \ /-name "Spring Boot Passkeys" \ /-description "Spring Boot Example" \ /-type regular \ /-callbacks http://localhost:8080/login/oauth2/code/okta \ /-logout-urls http://localhost:8080 \ /-reveal-secrets # Update OIDC credentials # Start the app $ ./gradlew bootRun a0.to/spring-passkey
34. @oktaDev | @deepu105 | deepu.tech Passkeys in Java apps
35. @oktaDev | @deepu105 | deepu.tech WebAuthn4j • FIDO2 conformant • Supports attestation validation • Supports all attestation formats • Suitable for relying party server implementation • Supports passkeys • Used by Keycloak • Has Spring Security support • Kotlin friendly java-webauthn-server • Not 100% FIDO2 conformant • Supports attestation validation • All attestation formats not supported • Suitable for relying party server implementation • Supports passkeys • From Yubico
36. @oktaDev | @deepu105 | deepu.tech Passkeys with Spring Security and WebAuthn4j Spring Boot web app as a relying party server using WebAuthn4j
37. @oktaDev | @deepu105 | deepu.tech WebAuthn4J Spring Security # Clone the repo $ git clone https://github.com/deepu105/webauthn4j-spring-boot-passkeys-demo # Start the app $ ./gradlew bootRun a0.to/spring-webauthn
38. @oktaDev | @deepu105 | deepu.tech Passkeys with Spring Security
39. @oktaDev | @deepu105 | deepu.tech spring-security-webauthn • Provides default registration and login pages • Will become a Spring Security core option • Based on WebAuthn4j • At experimental stage now • Expected in Spring Security 6.4 (November, hopefully)
40. @oktaDev | @deepu105 | deepu.tech How does it differ from WebAuthn MFA?
41. @oktaDev | @deepu105 | deepu.tech Passkeys • Implemented using WebAuthn and FIDO2 • Can be synced or device-bound • Discoverable credentials (Resident keys) • Can be used for account registration as first factor • Enrollment required only once for synced passkeys WebAuthn MFA • Implemented using WebAuthn and FIDO2 • Only device-bound • Non-Discoverable credentials • Can only be second factor after account registration with password • Enrollment required on each device
42. @oktaDev | @deepu105 | deepu.tech https://learnpasskeys.io https://webauthn.me/passkeys https://passkeys.dev https://passkey.org https://fidoalliance.org/passkeys Resources
43. @oktaDev | @deepu105 | deepu.tech Passkeys login challenge • Complete the challenge and visit our booth to win some cool prizes • Only for first 15 completed submissions a0.to/passkey-challenge
44. Authorization Authentication Security Single Sign-On | Adaptive Multi-Factor Authentication | Universal Login | Passwordless | Bot Detection & Prevention | Security Center | Breached Password Detection | Brute Force Protection | FGA How we can help: Try Free Today: Free Plan (forever) $0 Up to 7,500 monthly active users. Unlimited user logins. Includes passkeys support*. No credit card required. Special Plans for Startups & Nonprofits Plans for Everyone B2C: your users are consumers B2B: your users are businesses or a mix of businesses and consumers Enterprise: Best for production applications that need to scale - Contact Us Make login our problem. Not yours. a0.to/plg_signup
45. @oktaDev | @deepu105 | deepu.tech Thank You Subscribe to our newsletter a0.to/nl-signup/java Try our free Spring Boot microservices workshop a0.to/spring-boot
46. @oktaDev | @deepu105 | deepu.tech menti results