Securing Angular Apps with OpenID Connect and OAuth2

Course Overview
Hi, this is Brian Noyes, and welcome to my course, Securing Angular Apps with OpenID Connect and OAuth2. I'm a software architect with over 20 years of experience and have been working with Angular and other single-page application frameworks for over 5 years. I've seen many approaches to security, some good and some really bad. It's never been more important to make sure the apps you build and the data they manage are securer than it is today. There's also a growing expectation from users that apps will participate in a single sign-on experience for the user so they don't have to remember and use separate accounts for every app they work with. In this course I'll show you how you can use OpenID Connect and OAuth2 protocols to secure your Angular apps with the most modern, interoperable, standardized, and secure protocols, and ones that allow your app to be part of a single sign-on ecosystem of apps for your users. You'll see how to handle the authentication process, getting your users logged in, and authorization, or access control, to make sure users can only see and do what they're supposed to within your app and the back-end APIs that your app talks to. I'm really looking forward to showing you how easy it can be to do the right thing with security in your Angular apps.

Authenticating with OpenID Connect
Hi, this is Brian Noyes. In this module we're going to start drilling down into authentication with OpenID Connect. I'll cover a few more details of the protocols than I did in the first module and then we'll dive into starting to hook things up in the sample app. So first up I will review some of the reasons for adopting OpenID Connect for your authentication protocol. Next, I'll review the different authentication flows that are defined as part of the OpenID Connect protocol and we'll talk about which kinds of applications should use which. Then we'll dive into coding for the rest of the module, starting with the sample app you saw in the first module, but stripped down to just the raw functionality with no security hooked up yet. In this module we'll add the code to log on with an OpenID Connect identity provider and then later modules will expand on that with authorization code, token management, and managing the user experience based on the security context of the user. For brevity throughout the rest of the course I will often refer to the OpenID Connect Identity Provider as simply the IdP, for short, or STS for short, both terms are essentially equivalent. Likewise, I'll use OIDC as an abbreviation and quicker way of saying OpenID Connect.

Authorizing Calls to Your Backend APIs with OAuth2
Hi this is Brian Noyes. In this module we're going to focus on authorization with the OAuth2 protocol. I'll again start with some conceptual coverage of the protocol without getting too much in the weeds and then we'll spend most of the module working through demos showing you how to leverage the capabilities of OAuth2 in your apps. First, I'll cover a few more details about the OAuth2 protocol itself. You'll see that there's a lot of overlap with the OpenID Connect protocol details that I covered in the last module, which his not surprising since OpenID Connect is a derivative spec from OAuth2, which preceded it. Then I'll step through showing you how to start using the OAuth2 access token to authorize calls to your back-end, which also enables those services to filter data or restrict access to certain APIs or functionality based on the identity of the caller. Although this course is mostly focused on what you need to do in your front-end Angular app, you can't talk about authorization and access control without getting into some specifics about whatever back-end technology you're using for your APIs. So I'll be showing how to authorize calls, filter data, and enforce access control in the ASP. NET Core APIs that I'm using for the back-end of this course's sample app. But don't worry if you're going to be using something else on the back-end, the concepts and general approach are very similar regardless of what API stack you are using. Just the specific framework mechanisms and code will vary a bit.