Examkin

Question

Difficulty: MediumIdentity and Access Management Operations

An enterprise mobile application authenticates users via a cloud-hosted Identity Provider (IdP) using the OAuth 2.0 Authorization Code Flow with Proof Key for Code Exchange (PKCE). Place the operational steps of this authentication sequence in the correct order, from initial client initialization to final token delivery.

  1. 1The client application generates a secret code_verifier and calculates its SHA-256 hash to create the code_challenge.
  2. 2The client redirects the user to the IdP authorization endpoint, transmitting the client_id, requested scope, and code_challenge.
  3. 3The IdP authenticates the user, records the code_challenge, and issues a temporary authorization code back to the client.
  4. 4The client application sends a DIRECT POST request to the IdP token endpoint containing the authorization code and plaintext code_verifier.
  5. 5The IdP hashes the code_verifier, confirms it matches the stored code_challenge, and issues the access and ID tokens.

Answer

The correct operational sequence is: 1) Client generates the secret code_verifier and computes the code_challenge, 2) Client redirects user to IdP authorization endpoint with the code_challenge, 3) IdP authenticates user and issues an authorization code bound to the code_challenge, 4) Client sends authorization code and plaintext code_verifier to IdP token endpoint, 5) IdP verifies code_verifier against code_challenge and issues access tokens.
Proof Key for Code Exchange (PKCE) mitigates authorization code interception attacks on public clients. The client first creates a secret code_verifier and calculates the code_challenge. Next, it sends the user to the IdP authorization endpoint carrying the code_challenge. After successful user authentication, the IdP returns an authorization code. The client then exchanges this authorization code by sending the plaintext code_verifier directly to the token endpoint. Finally, the IdP verifies that SHA-256 hashing of the code_verifier matches the code_challenge stored during authorization before issuing access and ID tokens.

Step-by-Step Solution

1
Generate local cryptographic parameters
The client establishes the secret code_verifier and derives the public code_challenge using SHA-256.
PKCE protects public clients against authorization code interception by establishing a secret known only to the legitimate client instance before initiating communication.
2
Initiate authorization request
The client redirects the browser/user-agent to the IdP authorization URI containing the code_challenge.
The IdP needs the code_challenge to associate it with the authorization request session prior to user authentication.
3
Authenticate user and issue authorization code
The IdP validates user credentials and issues a short-lived authorization code.
The authorization code represents temporary authorization granted by the resource owner to the client.
4
Exchange authorization code for tokens
The client makes a POST request to the token endpoint supplying the authorization code and the plaintext code_verifier.
Presenting the unhashed code_verifier proves that the party requesting tokens is the exact same application instance that generated the initial request.
5
Validate verifier and deliver tokens
The IdP hashes the received code_verifier, compares it to the original code_challenge, and returns security tokens.
Token issuance is granted only when SHA-256(code_verifier) strictly equals the code_challenge recorded in Step 3.

Key Concept

OAuth 2.0 Authorization Code Flow with PKCE (Proof Key for Code Exchange)
Estimated Time:1m 30s
Rate this question

Topics

Identity and Access Management Operations

More questions from this topic