Using an mTLS Identity Provider to achieve Password-less auth...
summary
Pinterest builds a custom IdP that replaces Okta SSO by validating device-bound client certificates at the Edge (Envoy does TLS termination and cert checks) and uses an OIDC service with no internal auth. Certificates are provisioned only to MDM-enrolled devices and device posture is evaluated at auth time from EDR, MDM, osquery and logs against pass/block policies. Browser mTLS caching is handled by random subdomain redirects to force new prompts; webviews break this flow. Early compliance metrics are inconclusive (<6 weeks).
AI-written summary · about
chapters (7)
- 0:00Introduction to talk
- 1:04OCTA device trust options
- 3:34Certificate-based device attestation
- 7:32Browser mTLS user experience
- 10:28Device health attestation process
- 13:21Native app compatibility issues
- 15:09Q&A session
related talks
28mBuilding Identity for an Open Perimeter
34mThrow Away Your Passwords: Trusting Workload Identity
25mNavigating the implementation and roll out of passwordless authentication
18mShifting Authentication at Scale
27mYou Shall Not Pass
19mAdvanced Authentication Framework
46mAuthentication Without Authentication
25mOAuth Gets You In, Zero Trust Keeps You Safe