BT

Facilitating the Spread of Knowledge and Innovation in Professional Software Development

Write for InfoQ
News Articles Presentations Podcasts Guides

Topics

Choose your language

QCon New York

Find real-world practical inspiration from the world’s most innovative software leaders. Attend in-person.
QCon San Francisco

Learn what's next in software from world-class leaders pushing the boundaries. Attend in-person or get video-only pass to recordings.
The Software Architects' Newsletter

Your monthly guide to all the topics, technologies and techniques that every professional needs to know about. Subscribe for free.

InfoQ Homepage Presentations OpenID Connect & OAuth - Demystifying Cloud Identity

Cloud
QCon New York (June 13-15): Learn best practices from senior developers at early adopter companies.

OpenID Connect & OAuth - Demystifying Cloud Identity

Bookmarks
01:06:25

Summary

Filip Hanik and Sree Tummidi talk about the OpenID Connect and OAuth 2 standards, the most popular authentication and authorization frameworks used in native cloud applications today. They share their experiences building the Cloud Foundry User Authentication and Account management project, a production grade OAuth 2 authorization and resource server, as well as an OpenID Connect implementation.

Bio

Filip Hanik works as a Senior Staff Engineer at Pivotal. Sree Tummidi is the Product Manager for Identity & Access Management on Pivotal Cloud Foundry.

About the conference

SpringOne Platform brings together the people, process and tools for delivering and operating software services. Learn and share with the startups and enterprises leveraging modern Java with Spring connecting all the pieces of the modern software puzzle from developer, operator, architect, data scientist to executive.

Recorded at:

Dec 10, 2016

This content is in the Cloud topic

Related Topics:

Hello stranger!

You need to Register an InfoQ account or or login to post comments. But there's so much more behind being registered.

Get the most out of the InfoQ experience.

Allowed html: a,b,br,blockquote,i,li,pre,u,ul,p

Community comments

  • OAuth does not equal OpenID Connect

    by Gluu Federation,

    Your message is awaiting moderation. Thank you for participating in the discussion.

    What I see a lot is that people use OAuth2 clients, which work with OpenID Connect, but do not use the security features of OpenID Connect. Is this code verifying the nonce in the id_token? Does it follow all the recommendations in the OpenID Connect basic client implementers guide. Working code is great. But secure code is better. See www.gluu.co/oauth-saml-openid on OAuth v. SAML v. OpenID Connect for a deeper discussion. Also, consider using a client like oxd.gluu.org oxd which provides a secure implementation of OpenID Connect client calls, without some of the complexity required by a low level OAuth client.

    Back to top

Allowed html: a,b,br,blockquote,i,li,pre,u,ul,p

Allowed html: a,b,br,blockquote,i,li,pre,u,ul,p

BT