Lesson 4 : How to secure AWS ALB using Auth0 & OIDC?

This is the second video in the series to secure AWS ALB using a OIDC provider :
Step 1 : Configure a AWS ALB with HTTPS listener • Lesson 1 : How to secu...
Step 2 : Configure Auth0 as the OIDC provider
#aws #amazonwebservices #openid #auth0 #authentication #iam #identity #amazonwebservices #awsalb #security

[@securityinaction1018]

Please subscribe to this channel for regular updates kzbin.info/door/EEayyyCrJO94FYlzF0NLTg Thank You for the support.

[@NimitSharma1988]

I really liked the way you explained this workflow. Is it possible if you can create a video to configure Keycloak as AWS ALB OIDC Idp ?

[@securityinaction1018]

Thank You. I have not used Keycloak before. I will let you know if I post a video using keycloak. I hope it should work the same way as any other Identity Provider.

[@NimitSharma1988]

@@securityinaction1018 The workflow is indeed same but I am getting 561 Authentication Error for some reason.

[@securityinaction1018]

I think it should be some configuration issue in KeyCloak or ALB. You can check if this solution works. stackoverflow.com/questions/62820277/aws-application-load-balancer-with-onelogin-giving-561-authentication-error#:~:text=HTTP%20561%3A%20Unauthorized%20You%20configured,code%20when%20authenticating%20the%20user

[@dtefft]

Can you use a similar configuration for machine to machine APIs or does this ALB set up only work for user applications?

[@securityinaction1018]

This ALB setup uses OIDC Authorization code grant flow which involves user interaction. For M2M or Machine-To-Machine APIs, you can use AWS API gateway. Front-end app can be behind ALB which will perform a user authentication and generate ID, Access & Refresh tokens. Backend APIs can be behind API Gateway which will validate the access token to allow / deny access.

[@saikatghosh8437]

Could you please share the app thats running, i am trying the same but not sure how to read the headers. Thanks in advance.

[@securityinaction1018]

Are you referring to the lambda function that returns the headers? If so, please share the code here and I can check it.

[@saikatghosh8437]

Yes, I am not sure how to write it, if you could help with some example method. Thanks

[@securityinaction1018]

Please watch this video kzbin.info/www/bejne/aWKngoyiqap_nZo to create that lambda function. This link is also available in the details section.