Presentation on Security Standards and Protocols
summary
Overview of practical security standards and protocols: explains why SAML2 remains dominant for corporate federation but has problems on mobile, clarifies that OAuth2 is for delegated authorization (detailing the authorization code and refresh token flows), and shows why JWTs are three Base64 parts and how to validate them. Also covers Kerberos, WS-* integration, and XACML for fine-grained policies, and describes a token-server prototype issuing OpenID Connect tokens to bridge legacy SAML/Active Directory with modern APIs.
AI-written summary · about
chapters (14)
- 0:00Security standards intro
- 3:31Authentication basics
- 5:18App security changes
- 8:29Role of standards
- 9:13Tokens and standards
- 13:49SSO and federation
- 17:49OpenID Connect evolution
- 19:53JWT and SWT tokens
- 25:18OAuth 2.0 applications
- 33:23Kerberos machine auth
- 36:10WS-Trust and WS-Federation
- 37:56XACML complex auth
- 40:28Integrating new standards
- 42:17Summary and Q&A
related talks
30mInsecurity protocols: an overview of modern authentication
47mModern Authentication 101
46mSecure SSO Authentication: Strategies to Eliminate Vulnerabilities
21mBuilding Neo-security Platforms: Securing APIs using modern standards
46mA Deep Dive into the Past, Present & Future of OAuth
55mYou Shall Not Password: Modern Authentication for Web Apps
47mho Are You? Delegation, Federation, Assertions and Claims
01h 02mOpenID Connect & OAuth 2.0 – Security Best Practices