Modern And Secure IAM For Modern Applications

on YouTube ↗32m

" summary

Argues for a central federated IAM instead of per-app auth and names OpenID Connect and JWT for identity tokens, PKCE for public clients and FIDO2 for phishing-resistant, public‑key logins. Cites studies: 81% of breaches involve stolen or weak credentials, 91% of attacks target credentials, 73% password reuse. Recommends reuse of certified providers (Keycloak, IdentityServer), shows discovery endpoints and a live FIDO2 registration that produces a public key and works end to end.

AI-written summary · about

" chapters (26)

1. 0:00Intro
2. 0:27Identity
3. 3:10Secure IAM
4. 3:52Studies
5. 4:26NIST
6. 4:50Application Security Verification Standard
7. 5:10Traditional IAM
8. 6:15Modern IAM
9. 9:44OpenID
10. 10:26OpenID Foundation
11. 11:25JSON Web Token
12. 15:09Authorization Code Flow
13. 16:36Discovery End Point
14. 17:01Public Key
15. 17:18SAML
16. 19:01Benefits
17. 20:29Certification
18. 22:13Custom Implementation
19. 22:54FIDO
20. 23:31Public Key Cryptography
21. 24:00Different Protocols
22. 24:24Phishing
23. 24:56Forms of Authenticator
24. 25:27Demo
25. 27:19FIDO Server
26. 28:29Questions

" related talks

• 37mCustomer Identity for Modern Apps and APIsLoïc Loewert · Apidays LIVE Paris 2020
• 40mModern Identity ManagementMercedes Wyss · PyCon Latam 2019
• 01h 12mIdentity 2.0: the what, why and how of social and federated loginFraser Tweedale · PyCon AU 2017
• 45mModern Identity Management in the Era of Serverless and MicroservicesMercedes Wyss · Devoxx Belgium 2019
• 35mIdentity and Access Management for the Decade AheadThivaharan Kalyanasundaram · Open Source Summit India 2026
• 51mYou Shall Not Password: Modern Authentication for Web AppsEli Holderness · NDC Sydney 2022
• 55mYou Shall Not Password: Modern Authentication for Web AppsEli Holderness · Copenhagen Developers Festival 2023
• 21mEarning Trust in Identity at ScaleSarah Cecchetti, Arynn Crow · Authenticate 2022