ho Are You? Delegation, Federation, Assertions and Claims

on YouTube ↗47m

" summary

Compares concrete tradeoffs: SAML assertions are XML and large with artifact resolution and XML signature pitfalls, versus OpenID Connect uses compact JWT ID tokens and Discovery and supports PKCE for public clients. Demonstrates the practical JWT hazard where a token’s alg header can be abused, recommends Doorkeeper openid_connect, jwt.io and oidcdebugger.com for local testing, and warns that SSO creates a single point of failure and that libraries must be kept patched.

AI-written summary · about

" chapters (14)

1. 0:00Introduction
2. 3:00Authentication
3. 8:51SAML
4. 17:24Trustworthy Assertions
5. 20:22XML Signatures
6. 21:23OAuth
7. 24:54OpenID Connect
8. 25:49OpenID Connect vs SAML
9. 28:37Authorization Code Flow
10. 35:00Why Do I Care
11. 39:50Assumptions
12. 42:05Conclusion
13. 43:53Other Considerations
14. 44:38Additional Resources

" related talks

• 34mWho Are You? I Really Want to Know… the Magic Behind OIDCEddie Zaneski · CloudNativeSecurityCon North America 2023
• 47mModern Authentication 101Dasith Wijesiriwardena · DDD Melbourne 2019
• 44mPresentation on Security Standards and ProtocolsBolesław Dawidowicz · Confitura 2015
• 01h 12mIdentity 2.0: the what, why and how of social and federated loginFraser Tweedale · PyCon AU 2017
• 40mKnock knock, who's there? Authenticating your single page apps using JSON Web TokensSam Bellen · GrillJS 2019
• 33mOAuth and OpenID Connect Deep DiveTravis Spencer · Nordic APIs Stockholm 2013
• 28mOAuth 2.0 and OIDCSara Daqiq · Silicon Valley Code Camp 2018
• 45mWhy We Should Kill Saml2Anders Abel · NDC Security 2022