thread-safe.com

seriouslyidentity.com

Cryptography – identity

http://seriouslyidentity.com/tag/cryptography

Part of the s.erious.ly real-time news network. Other s.erious.ly sites. Publishers Opt-in or Out. Token Binding for Access Tokens, Refresh Tokens, and ID Tokens. Two new related specifications define syntax and semantics for applying Token Binding to OAuth Access Tokens and Refresh Tokens and to OpenID Connect ID Tokens. draft-jones-oauth-token-binding. Contains the OAuth portions. openid-connect-token-bound-authentication-1 0. Https:/ tools.ietf.org/html/draft-jones-oauth-token-binding-00. Leave a comm...

openid-foundation-japan.github.io

Draft: OpenID Connect Implicit Client Implementer's Guide 1.0 - draft 15

http://openid-foundation-japan.github.io/openid-connect-implicit-1_0.ja.html

February 25, 2014. OpenID Connect Implicit Client Implementer's Guide 1.0 - draft 15. OpenID Connect 1.0 は, OAuth 2.0 プロトコルの上にシンプルなアイデンティティレイヤーを付与したものである. このプロトコルは, Client が Authorization Server の認証結果に基づいて End-User のアイデンティティを検証することを可能にする. また同時に End-User の必要最低限のプロフィール情報を, 相互運用可能かつ RESTful な形で取得することも可能にする. OpenID Provider および Web ベース以外のアプリケーションの実装者は, Core 仕様を参照のこと. Requirements Notation and Conventions. Client Prepares Authentication Request. Client Sends Request to Authorization Server. Sakimura, N., ...

self-issued.info

Proof-of-Possession Key Semantics for JSON Web Tokens (JWTs)

https://self-issued.info/docs/draft-ietf-oauth-proof-of-possession-03.html

Intended status: Standards Track. Expires: January 7, 2016. July 6, 2015. Proof-of-Possession Key Semantics for JSON Web Tokens (JWTs). This specification defines how to express a declaration in a JSON Web Token (JWT) that the presenter of the JWT possesses a particular key and that the recipient can cryptographically confirm proof-of-possession of the key by the presenter. This property is also sometimes described as the presenter being a holder-of-key. Status of this Memo. This specification defines ho...

xmlgrrl.com

Pushing String | Author Archives

http://www.xmlgrrl.com/blog/author/site-admin

A new identity relationship. I’ve been writing on this blog about identity and relationships for a long time (some samples. 8230;). Now I’ve forged (see what I did there? A new relationship, and have joined. ForgeRock’s Office of the CTO. Check out my first post. On the ForgeRock blog. I’m really psyched about this company and my new opportunities to make cool Identity Relationship Management progress there. And I’ve found a lot of fellow rock ‘n’ rollers. New: Modern authorization systems and XACML.

self-issued.info

JSON Web Token (JWT)

http://self-issued.info/docs/draft-ietf-oauth-json-web-token.html

Internet Engineering Task Force (IETF). Request for Comments: 7519. JSON Web Token (JWT). JSON Web Token (JWT) is a compact, URL-safe means of representing claims to be transferred between two parties. The claims in a JWT are encoded as a JSON object that is used as the payload of a JSON Web Signature (JWS) structure or as the plaintext of a JSON Web Encryption (JWE) structure, enabling the claims to be digitally signed or integrity protected with a Message Authentication Code (MAC) and/or encrypted.

openid-foundation-japan.github.io

Draft: OpenID Connect Basic Client Implementer's Guide 1.0 - draft 33

http://openid-foundation-japan.github.io/openid-connect-basic-1_0.ja.html

February 25, 2014. OpenID Connect Basic Client Implementer's Guide 1.0 - draft 33. OpenID Connect 1.0 は, OAuth 2.0 プロトコルの上にシンプルなアイデンティティレイヤーを付与したものである. このプロトコルは, Client が Authorization Server の認証結果に基づいて End-User のアイデンティティを検証することを可能にする. また同時に End-User の必要最低限のプロフィール情報を, 相互運用可能かつ RESTful な形で取得することも可能にする. OpenID Provider および Web ベース以外のアプリケーションの実装者は, Core 仕様を参照のこと. Requirements Notation and Conventions. Client Prepares Authentication Request. Client Sends Request to Authorization Server. Authorization Code Fl...

xmlgrrl.com

Pushing String | Category Archive | Venn

http://www.xmlgrrl.com/blog/categories/venn

New post: Venn of access control for the API economy. Up on the Forrester blogs. I present a new Venn diagram that compares OAuth, OpenID Connect, and UMA. A number of people contributed to the final form of this one, which we presented in a Google Tech Talk a couple of weeks back. Thanks to all of the following folks (listed in no particular order) for their feedback! Spread the word, join us, and get all your questions answered…. I’ve got a new post. Which is full of Venn goodness! The recent 37signals...

seriouslyidentity.com

Federation – identity

http://seriouslyidentity.com/tag/federation

Part of the s.erious.ly real-time news network. Other s.erious.ly sites. Publishers Opt-in or Out. OpenID Connect EAP ACR Values specification. The OpenID Connect Extended Authentication Profile (EAP) ACR Values 1.0 specification has been submitted to the OpenID Enhanced Authentication Profile (EAP) working group. The specification is glue that ties together OpenID Connect. And FIDO Authenticators, enabling them to be seamlessly used together. The specification is available at:. This completes publicatio...

self-issued.info

Proof-Of-Possession Semantics for JSON Web Tokens (JWTs)

http://self-issued.info/docs/draft-ietf-oauth-proof-of-possession-02.html

Intended status: Standards Track. Expires: September 10, 2015. March 9, 2015. Proof-Of-Possession Semantics for JSON Web Tokens (JWTs). This specification defines how to express a declaration in a JSON Web Token (JWT) that the presenter of the JWT possesses a particular key and that the recipient can cryptographically confirm proof-of-possession of the key by the presenter. This property is also sometimes described as the presenter being a holder-of-key. Status of this Memo. Jones, M., Bradley, J&#46...