The OpenID Foundation has created a test and self-certification program for OpenID Connect protocol implementations to stimulate interoperability, deployment and robustness of these implementations. This presentation provides an introduction into the OpenID Foundation and the OpenID Connect self-certification program and will cover the following topics:
- what is the OpenID Foundation and how does it compare to other standardization organizations
- what is OpenID Connect self-certification and why does it matter
- how can self-certification be achieved by implementations and deployments
- how certification can be achieved by implementations
Key takeaways:
The OAuth working group recently decided to discourage use of the implicit grant. But that’s just the most prominent recommendation the working group is about to publish in the upcoming OAuth 2.0 Security Best Current Best Practice (https://tools.ietf.org/html/draft-ietf-oauth-security-topics), which will elevate OAuth security to the next level. The code flow shall be used with PKCE only and tokens should be sender constraint to just mention a few. Development of this enhanced recommendations was driven by several factors, including experiences gathered in the field, security research results, the increased dynamics and sensitivity of the use cases OAuth is used protect and technological changes. This session will present the new security recommendations in detail along with the underlying rationales.
Key takeaways:
Guaranteeing maximum security while providing your users with a frictionless experience is a persistent challenge. The more we shift into the digital environment, the more it requires every business to pay critical attention to user experience as boosting customer satisfaction by providing better usability and accessibility in the interaction with every aspect of a product is crucial. This is where next-generation authentication comes into play, decreasing disparities between security and user experience. Given the ever-changing, ever-improving nature of technologies, devices and networks, the combination of SSO, UBA, MFA and other authentication solutions is a gamechanger, allowing companies to apply precisely the right level of gateway security to each and every login request. In this panel, we will address the existing authentication challenges for companies and what next-generation solutions can bring to the table.
