UAA Project Updates and Roadmap - Sree Tummidi, Pivotal
summary
UAA now adds canary-style key rotation and allows each OAuth client to hold two secrets so operators can rotate without downtime; tokens are JWT by default but UAA supports opaque tokens with revocation (persisted when revocable) and a token exchange for SAML→OAuth or JWT→JWT to bridge legacy and microservice flows. Backup/restore uses BOSH BBR with a pre-backup lock that leaves login read-only, supported for MySQL and Postgres (SQL Server recently added). New tooling includes a Go UAA CLI, a JavaScript SDK, and work on MFA and fine-grained permissions.
AI-written summary · about
chapters (14)
- 0:00Intro
- 0:38UAA & CF CLI
- 2:56UAA & CF Router
- 4:20UAA Architecture in CF
- 8:53UAA - Multi tenancy
- 10:55Token Format - JWT
- 12:37Client Side Integrations
- 15:33UAA Keys & Client Secret Rotation
- 18:07OpenID Connect Enhancements
- 20:16UAA DB - Backup and Restore
- 23:08Opaque & Revocable Token Support
- 25:41Token Exchange - External IDP
- 28:22Token Exchange - Microservices
- 36:16Team Identity
related talks
41mUAA Feature Updates and 2017 Roadmap
15mEvolution of UAA Towards OAuth 2.1 and OpenID Foundation
31mCloud Foundry UAA as an Identity Proxy Product Roadmap
37mDeploying UAA to Cloud Foundry and using within your Applications
31mUser Account and Authorization Server at SAP
01h 22mIdentity for AI Agents
24mBuilding Trustworthy AI Authentication & Authorization for AI Agents
39mCloud Foundry UAA as an Identity Gateway