Apisecure, 14 & 15 March 2023 - Edmund Olson Morgan at Marsh McLennanOAuth.
summary
Enterprise use case: long‑lived vendor credentials get removed behind a proxy so third parties never hold service secrets. Implementation uses OAuth2 client‑credentials with OIDC client_secret_jwt today and plans for private_key_jwt, Apigee hybrid as the gateway, token introspection, JTI replay caching, URI rewriting, scoped service credentials and response masking. Deployed facades protect Microsoft Graph for healthcare and HR vendors and a banking leasing flow; libraries and SDKs are built and the pattern is working in production.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 2:09Business problem context
- 8:51Credential abstraction pattern
- 17:12OAuth client secrets risks
- 24:40Client secret JWT details
- 31:01Real-world credential examples
- 35:14Future plans
- 41:20Q&A security & quantum
- 46:15Q&A auth & resources
related talks
29mAPI Security in 2017
48mAPI Security for Enterprises fireside chat
46mBearer of Good News
23mIdentity Best Practices to Secure & Scale Agentic AI / MCP Deployments
25mOAuth Gets You In, Zero Trust Keeps You Safe
50mArchitectural Patterns for Spring Security You Wish Your Tech Lead Knew
17mFortifying Microservice Security with SPIRE and OPA
55mSupercharging OAuth 2.0 security