<div dir="ltr">Hello group,<div><br></div><div>just a quick follow-up from the IETF OAuth Security workshop from last July.</div><div>The workshop was well attended: security researches and some big names like google, microsoft, facebook, deutsche telekom, ping identity, <a href="http://openid.net">openid.net</a> were all represented etc.</div><div><br></div><div>There were some interesting talks about using OAuth in IoT scenarios and how the related standards (cbor, cwt, etc.) can be applied.</div><div>Another interesting topic was the theory and practice of the recently found IdP Mix-Up attack.</div><div><br></div><div>Links to the talks (slides / papers) are here [0] (unfortunately they were not recorded).</div><div><br></div><div>There were also some tools mentioned for checking Identity Providers for well known attacks (PrOfESSOS) [0]</div><div>as well as OIDC compliance tests (oictest) [2] that can be run locally, </div><div>it's an easy to setup python app that also runs behind the official conformance testing portal of the <a href="http://openid.net">openid.net</a> [3] - running it locally might make things easier to test ;-)</div><div><br></div><div>Btw. I pitched keycloak quite often - folks were really keen to look at it ;-)</div><div><br></div><div><div>Cheers,</div><div>Thomas</div></div><div><br></div><div>[0] <a href="https://infsec.uni-trier.de/events/osw2016/schedule">https://infsec.uni-trier.de/events/osw2016/schedule</a></div><div>[1] <a href="https://github.com/RUB-NDS/PrOfESSOS">https://github.com/RUB-NDS/PrOfESSOS</a></div><div>[2] <a href="https://github.com/rohe/oictest">https://github.com/rohe/oictest</a><br></div><div>[3] <a href="https://openid.net/certification/testing/">https://openid.net/certification/testing/</a></div></div><div class="gmail_extra"><br><div class="gmail_quote">2016-06-22 7:56 GMT+02:00 Stian Thorgersen <span dir="ltr"><<a href="mailto:sthorger@redhat.com" target="_blank">sthorger@redhat.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hi, thanks for letting us now. A summary to the list afterwards would be appreciated, especially any advice on improving security.</div><div class="gmail_extra"><br><div class="gmail_quote"><div><div class="h5">On 21 June 2016 at 11:04, Thomas Darimont <span dir="ltr"><<a href="mailto:thomas.darimont@googlemail.com" target="_blank">thomas.darimont@googlemail.<wbr>com</a>></span> wrote:<br></div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="h5"><div dir="ltr"><div>Hello group,</div><div><br></div><div>just wanted to let you know that there will be an OAuth Security Workshop at the </div><div>University of Trier (Germany) in July see: <a href="https://infsec.uni-trier.de/events/osw2016" target="_blank">https://infsec.uni-trier.de/<wbr>events/osw2016</a></div><div><br></div><div>I learned from one of the organizers that they will also discuss Keycloak as</div><div>an OpenID Connect Provider - just wanted to let you guys know.</div><div><br></div><div>I'm going to attend this workshop as well.</div><div><br></div><div>Cheers,</div><div>Thomas</div></div>
<br></div></div>______________________________<wbr>_________________<br>
keycloak-dev mailing list<br>
<a href="mailto:keycloak-dev@lists.jboss.org" target="_blank">keycloak-dev@lists.jboss.org</a><br>
<a href="https://lists.jboss.org/mailman/listinfo/keycloak-dev" rel="noreferrer" target="_blank">https://lists.jboss.org/<wbr>mailman/listinfo/keycloak-dev</a><br></blockquote></div><br></div>
</blockquote></div><br></div>