Securing Workloads with Transaction Tokens and Minicloak
summary
Implements the IETF Transaction Tokens draft as a proof‑of‑concept Keycloak plugin (≈300 lines, 2 classes) that performs the basic token‑exchange flow, demonstrated with a Docker Compose demo: 5 containers (edge, emulated external auth, Keycloak TTS, two services). Transaction tokens are signed JWTs, one‑time use, include request context and use a new header instead of Authorization. Deployment options evaluated: embedded in gateway, embedded in auth server, or standalone (chosen). Performance notes: Quarkus Keycloak starts in 5–9s; experimental native build drops startup under 0.5s; production readiness and full flows remain incomplete.
AI-written summary · about
chapters (15)
- 0:00Workload security in zero trust
- 1:27External token propagation issues
- 3:54Multi-issuer token validation
- 6:22Transaction tokens as solution
- 7:46How transaction tokens work
- 9:56Token exchange protocols
- 12:50Deployment models for tokens
- 16:47Why Keycloak fits
- 18:54Implementing in Keycloak
- 20:18Live demo workflow
- 22:59Stateless scaling tokens
- 24:23Keycloak performance
- 25:46Retrofitting token propagation
- 27:36Future roadmap
- 28:45Q&A
related talks
37mHow Does a Workload Authenticate an API Request?: Implementing Transaction Token...
25mBridging the Gap Between Human and Workload Identity: SPIFFE Support in Keycloak
36mSecuring Agentic Platforms with Zero-Trust Workload Identities
25mIdentities and Authentication for Your Agents With Keycloak
01h 03mSingle Sign On with Keycloak: why and how
31mHigh-level API Security
27mEvolving OpenID Connect and Observability in Keycloak
26mKeycloak Introduction and Demo