search

IdentityServer / IdentityServer3

OpenID Connect Provider and OAuth 2.0 Authorization Server Framework for ASP.NET 4.x/Katana
https://identityserver.github.io/Documentation/
Apache License 2.0
2.01k stars 763 forks source link

Idsvr3 - Client Credentials - How to restrict the access token generation for specific clientserver IP addresses #3879

Closed ObjectNullReference closed 7 years ago

ObjectNullReference commented 7 years ago

@brockallen @damianh

Question

Hi,

We are using the Client Credentials OAuth2 flow. Client is an Asp.net web application, and request token code is part of the code behind file on server side.

But if some how some one could able to get the client_id, and secret_key, they will be able to get acces token. We would like to restrict the incoming IP traffic to certain restricted IPs (i.e. Server OutBound IPs where the client application is hosted). So can you clarify the below question in this regards.

  1. Does Idsvr3 has any functionality that restricts "client credentials flow" to certain/range IP addresses?

  2. How to automatically detect the client server IP address from which the request to the token is made. note: Not the User's IP address, but the IP address of the server where client website is hosted.

Appreciate your response.

Thanks, NullReference

damianh commented 7 years ago

Not entirely sure why I got named here but I supposition an answer :)

Does Idsvr3 has any functionality that restricts "client credentials flow" to certain/range IP addresses?

No, IdSrv does not do this and nor should it imho. For this to be effective and secure, you will want to do it as low down in the stack as possible. So this means firewall level first. If a multi-tenant application, then at reverse proxy / load balancer. And finally, if this is not possible, then in middleware in front of your oauth endpoints.

How to automatically detect the client server IP address from which the request to the token is made. note: Not the User's IP address, but the IP address of the server where client website is hosted.

Since it's Client Credentials flow you can use one of the HTTP request headers to get the remote (client) ip address: https://stackoverflow.com/a/916157

If the Client itself is compromised (and not the credentials being lifted and used elsewhere), then this won't help.

damianh commented 7 years ago

Also consider key rotation to mitigate.

leastprivilege commented 7 years ago

You seem to know a bit about security - you should come work for us ;)

damianh commented 7 years ago

lol

ObjectNullReference commented 7 years ago

Thank you @damianh Sorry, I mistakenly tagged you. But, your reply is very much helpful. Thanks for that.