Introduction au framework OpenID Shared Signals
summary
OpenID Shared Signals Framework standardizes real‑time delivery of security events using Security Event Token (RFC 8417) JWTs, subject identifiers and a stream-based publish/subscribe model with push and poll delivery and acknowledgements (guaranteed delivery versus OIDC backchannel logout). Implementations use OAuth for stream control, a transactional outbox for retries, and event profiles like C.A.P.E. and risk/SCIM. Demo shows Keycloak acting as transmitter delivering credential‑change and session‑revoked events immediately; Keycloak 26.7 transmitter experimental is planned and Quarkus receiver tooling is available.
AI-written summary · about
chapters (21)
- 0:00Introduction to speaker
- 1:07What is OpenID Shared Signals
- 5:22Use cases for Shared Signals
- 12:48Security Event Token structure
- 15:18Transmitter and receiver components
- 18:07Stream management in SSF
- 20:40Push delivery method
- 21:23Poll delivery method
- 25:02Companies using Shared Signals
- 26:48Event profiles overview
- 27:09Kiklo as SSF transmitter
- 28:10Kiklo as SSF receiver
- 29:35Demo with Cape Defaf
- 33:31Creating a stream in Kiklo
- 35:16Testing event delivery
- 37:48Transactional outbox in Kiklo
- 38:32Receiver demo with relying party
- 40:19Quarkus extension for SSF
- 42:53Identity federation with Apple
- 45:43Conclusion and next steps
- 47:08Q&A session
related talks
27mEvolving OpenID Connect and Observability in Keycloak
01h 12mIdentity 2.0: the what, why and how of social and federated login
31mDelegate Authentication and a Lot More To Keycloak With OpenID...
01h 03mSingle Sign On with Keycloak: why and how
28mOAuth 2.0 and OIDC
47mho Are You? Delegation, Federation, Assertions and Claims
54mWho's your user? OpenID from the ground-up
34mWho Are You? I Really Want to Know… the Magic Behind OIDC