IDPro and Identiverse have always had a close relationship. IDPro was formally launched at Cloud Identity Summit 2017 in Chicago (the same year we announced the rebrand to Identiverse) with a main stage talk by Ian Glazer and Sarah Cecchetti; for several years after, the two organisations maintained a semi-formal agreement, identifying Identiverse as the ‘home event’ of IDPro. Eventually, that agreement was allowed to lapse—it really wasn’t needed anymore, given the depth of engagement IDPro members have with the event.

The relationship shows up in a number of ways—informal gatherings, formal IDPro events, discount codes, constructive feedback from the community to the organisers, and much more besides…. But nowhere is it as apparent as in the responses we get from IDPro members to the annual Call for Presentations (“CFP”).

The core of the Identiverse agenda revolves around sharing leading practices: “here’s a problem I ran into, here’s how I solved it” (or sometimes “here are solutions I’m considering”). Who better than IDPro members to provide those kinds of perspectives?  Every year, the CFP is advertised via IDPro Connect Slack. Every year, I see ever more draft proposals being shared, ideas being floated, and advice being sought.

In case you didn’t know, nigh on 80% of the main Identiverse agenda comes through the CFP. We’ve had nearly two decades to refine the review and selection process; and whilst it will never be perfect—and is consequently the subject of routine, incremental review and improvement, even today—we have over that time established, tested, refined, and in some cases entirely replaced, a range of mechanisms that help us to ensure a fair process which ultimately results in a comprehensive and balanced agenda.  (If you’d like to know more, I’ve previously written in more detail about the agenda-building process in “The Art and Science of Agenda Building”, at https://www.hindleconsulting.com/posts/agenda_building/)

Identiverse—like IDPro—is also growing rapidly, in lockstep with a profession and an industry that are increasingly understood together as a (the!) vital enabler of the digital landscape. Partly as a result, we receive many more proposals every year than we can possibly accommodate on the agenda—for the 2026 CFP, by a factor of 5 —and we expect this will only increase in the coming years.

It’s at this point that people often ask me, “Well, if my chances are so slim, why should I propose?”  And to that question, I have several answers!  First: the act of preparing and submitting a proposal is, in and of itself, useful work. It can help refine and focus ideas; it can lead to new revelations or approaches to consider and discuss with others; and it’s a good way to sharpen the skills of distilling and clearly communicating complex concepts. On that latter point: yes, AI tools can help (although don’t feel that you have to, or even that you should use LLMs for this kind of work: they are just tools!): but only if given clear prompts to start with, and with careful editing and iteration during the process… and those are great skills to hone, too.

Even if your proposal isn’t accepted, it will be read and reviewed, which in turn helps inform the committee as to what matters topically to the community. That contribution, invisible to you though it may be, is nonetheless hugely influential in the development of the conference agenda, year after year.

You may, of course, choose to submit your proposal to several events, getting more than one-time use from your work. (Authenticate is another identity-focused conference that operates a very similar process to Identiverse, and is worth your consideration. There are others, too!)  Exercise some caution when you do this: several conferences ask whether your talk has been submitted to, or delivered at, other events. Don’t make assumptions about why that question is being asked: sometimes (as for Identiverse) it’s simply another data point for the committee. Do answer honestly—any conference that operates a rigorous process like Identiverse will easily find out if you mislead, and that can absolutely affect selection chances in future years!

But perhaps the most compelling reason is this: submitting a proposal to speak provides no guarantee whatsoever that your talk will be selected. But it’s a cast-iron certainty that your proposal cannot be selected if you don’t submit it!

The Identiverse 2027 Call for Presentations will open in October. Keep your eyes open for when it does. Talk to your colleagues, your friends, your peers. Get advice from the IDPro community about how to refine your proposal. And then get your work in front of the committee. It’s one of the best ways to contribute to the profession that I can think of.

About the Author

Andrew Hindle is an independent consultant and board advisor with deep expertise in digital identity, privacy, cybersecurity, and corporate governance, built across 25+ years in the global software industry. He works with boards, executives, and founders to navigate growth, risk, and strategic change in complex, fast-paced environments.

Andrew currently serves as a Non-Executive Director at Curity; as a board member at Women in Identity; and as Chair of the UK Advisory Board at the Kantara Initiative. He is a co-founder of The Identity Salon, and Conference Chair for Identiverse and Authenticate, where he works closely with industry leaders to curate high-quality, practitioner-focused content for the digital identity community. Andrew is also a Board Emeritus at IDPro, of which he was a founding member.

The post Symbiosis: Identiverse and IDPro appeared first on IDPro.

OSW Sessions of Interest

OSW is itself part conference, part unconference. The mornings are dedicated to proper talks, keynotes, and sessions for different horizons – students, researchers, security architects, seasoned RFC writers, thought leaders, startup founders, and even Digital Identity Advancement Foundation “Vittorio Bertocci Award” grantees. The afternoons are open for unconference-style open sessions, the contents of which are decided each day by popular vote. Several tracks were thus discussed, these being the latest and greatest work currently in progress or published in the OAuth universe at large. 

Verifiable Credentials

A set of sessions was dedicated to the various groups working on Verifiable Credentials and related specs (OID4VC, etc.). Kristina Yasuda and her peers showed that a lot of effort has been going into standardizing the formats for representing credentials, for building trust frameworks, and ensuring that these digital credentials can be read, presented and understood, and most importantly, trusted. A huge driver here is still the pan-European eIDAS initiative, whose goal is to provide all European citizens with Digital Credentials.

WIMSE-cal Workloads

On another tack, a lot of work has been going into securing Workloads, with the advent of the new Transaction Tokens and WIMSE specifications, as well as the new implementations of the not-so-new SPIFFE framework. As defined in the Transactions Token spec, a Workload is “An independent computational unit that can autonomously receive and process invocations, and can generate invocations of other workloads. Examples of workloads include containerized microservices, monolithic services and infrastructure services such as managed databases”. This also applies to our friends the AI Agents. Pieter Kasselman highlighted that workloads have two main problems: providing them with a provable unique identity that can enable them to authenticate with each other (support of which can be provided through SPIFFE, but also through a new concept of a Workload Identity Token or WIT), and ensuring that the same context is shared across all the workloads participating in the same transaction (achieved through Transaction Tokens). Access to any resource by any of these Workloads can then be properly authorized within the context of the operation at hand.

The Next Member of the OAuth Family

This topic led to some good follow-up discussions after Justin Richer presented the RFC on HTTP message signature, an alternative to DPoP, one of the legitimate children of OSW. What would happen if the workload couldn’t access the Authorization Server or the client key material? By the end of the conference a new proposal was submitted to IETF. Discussions in Bangkok promise to be epic.

FAPI

On the development/engineering security side, the FAPI 2.0 specification was also released recently. It included various updates to the security posture required from its various participants. As for gauging the security of Web Applications, the Open Worldwide Application Security Project (OWASP) just released its version 5.0 of its Application Security Verification Standard (ASVS). Elar Lang presented the ASVS project, whose primary goal is to provide an open application security standard for web apps and web services of all types. The standard provides a set of controls that can be used to assess or test the security of any system. Implementers can thus choose which controls to focus on to secure their applications.

Factors and Claims

Jeff Lombardo and Alex Babeanu have introduced a new set of claims for the JWT Access Token profile within the OAuth2 standard, along with a new flow. These proposed claims aim to enhance visibility into the Client entity itself. While existing OAuth2 flows provide extensive information about the end-user making requests to access resources (through access or ID token claims), there is little standardization around identifying and assessing the client application that the end-user is authorizing. Specifically, there is no widely accepted way to determine the level of assurance associated with the client entity. For example, how was the client authenticated? Was it a simple ID and secret, mTLS, or a signed JWT assertion? These methods vary significantly in security, with cryptographic signatures offering stronger assurances. Additionally, what security extensions were applied in the OAuth flow? Was PKCE or DPoP used? These factors can impact the overall security posture of a request.

Access Control Mechanisms

As access control mechanisms evolve, these considerations are becoming increasingly important. With the rise of AI agents, Policy Decision Points (PDPs) must assess not just the end-user but also the security of the calling application itself. By incorporating these new claims, PDPs can make more informed access control decisions, ensuring stronger and more adaptable security policies.

Thus, a better integration with AuthZEN-compliant Policy Decision Points (PDP) is proposed in a couple of ways:

• OAuth Authorization Servers (AS) should make direct AuthZEN calls to compliant PDPs as part of their usual token-minting ceremonies. This will supply the PDPs with the additional client claims described above to help in decision-making. (We are thinking in particular about RAR requests, which can be complex authorization requests).
  
• The authors also proposed a new Step-Up Authorization Protocol as an extension to RFC 9470, Step-Up Authentication Protocol. In this new flow, a Resource Server can request an Authorization Step-Up and require a new set of client claims from the client. The client is then responsible for obtaining these claims by, for example, authenticating using a stronger method (such as mTLS or signed assertions) and ensuring certain extensions (such as DPoP) are presented.

Work on drafts for these extensions has already started.

Closing With a Bang

Finally, as Mike Jones pointed out during his session entitled “The Cambrian explosion of OAuth and OpenID Specifications”, there are rather a LOT of standards in the OAuth universe, over 100. So much so that it can be hard for newcomers or implementers to find the right path in this forest. This is nevertheless also a sign of a healthy ecosystem, where more and more problems are tackled. Like the Cambrian explosion that our planet Earth experienced some 540 million years ago, we may be witnessing an explosion in the diversity of Digital Identity topics and concerns, a good sign that we will keep busy for the foreseeable future.

Disclaimer: The views expressed in the content are solely those of the author and do not necessarily reflect the views of the IDPro organization.

Authors:

Alex Babeanu is a seasoned expert with over two decades of building innovative IAM solutions using Graphs and Open Standards, as a principal Engineer, Consultant, Product Manager and CTO. A passionate advocate for the graph-based approach to IAM, Alex has presented at leading conferences and contributed extensively through published papers and blogs. As a founding member of IDPro and part of its editorial committee, Alex plays a key role in curating content for the organization’s monthly publications. Currently, he leads the Access Management product at Indykite, a cutting-edge platform that harnesses graph data and AI to simplify complex identity challenges.

Badges: IDPro Member, IDPro Editorial Committee, IDPro BoK Reviewer, IDPro Newsletter Author, IDPro Founding Member

Jeff Lombardo is a Solutions Architect expert in IAM, Application Security, and Data Protection. Through 15 years as an IAM consultant for French, Canadian, and US enterprises of all sizes and business verticals, he has delivered innovative solutions with respect to standards and governance frameworks. Since the last 5 years at AWS, he helps organizations enforce best practices and defense in depth for secure cloud adoption.

The post The OAuth Security Workshop 2025 appeared first on IDPro.

After having attended in person one Identiverse, two EICs, one AuthenticateCon, one IETF, one OSW and one IIW, I thought I definitely left behind the woes of the Lockdown Winter that forced our favorite events to take place in the netherspace that is Zoom or proprietary eponym equivalents. Boy, was I wrong. None of those events prepared me for a conference that takes over entire blocks, where the expo alone is large enough (700+ exhibitors!) to have its own weather system, if not its own zip code. Above all, I wasn’t prepared for an event where you no longer have direct line of sight with your tribe, and the majority of the badge-clad people are perfect strangers.

The very distrustful conference site (it asked for my username/password every couple of hours; is this what continuous authentication means?) offered a staggering 612 sessions. One first-time attendee asked me – “how do you choose what to attend at RSA?”. My answer: use the search feature to tease out what’s relevant to your interests. That is also what I have done: as a result, expect this report to be a very partial & personal account of the event. If you want to broaden your perspective, you can chat to other IDPros who were there; you’ll find them on #RSAConference in our IDPro Slack.

Content highlights

Despite all the rhetoric about identity being the new perimeter and other platitudes, and some shoutouts to OIDC and FIDO from the keynote, RSAC 2022 had very little content on our favorite topic. The Identity track had 44 sessions, 13 of them being vendor sponsored and 7 being duplicates (overflow rooms). 

While zero trust was still one of the dominating buzzwords, I was surprised to see that a search for “blockchain” only returned 5 sessions, “web3” exactly zero, and “decentralized” only one track session, from IDPro’s very own George Fletcher.

George’s session, “Managing De-Centralized Identities: A Relying Party Perspective”,  was one of the highlights of the conference for me. The first time I saw George present on this topic was at an IIW in 2019. In a nutshell, the session takes tools and principles of Self-Sovereign Identity (SSI)/decentralized identity and tries to apply them when developing a realistic relying party. In so doing, he uncovers discrepancies, opportunities and impedance mismatch that are both a powerful tool to understand SSI’s value proposition and an honest litmus test to assess the maturity level of those new technologies. TL;DR: things did improve since that first 2019 session, but much still needs to be figured out for those technologies to be viable in real world use. 

After the session, a bunch of IDPros and identirati congregated right outside, engaging in an incredibly satisfying 30 minute long discussion on VCs, passkeys and their potential impact on society. Those 30 minutes alone were worth the trip, what a JOY to be among one’s people!  

Passkeys were the centerpiece of the other awesome event-in-the-event I had the chance to attend, the half-day FIDO Alliance seminar on – surprise surprise – passwordless and passkeys in particular. The Apple WWDC announcements about passkeys created a huge interest around the topic, and the seminar was the perfect opportunity to demystify the technology and get a glimpse of the enormous potential it has to finally deliver a substantial blow to passwords in consumer authentication. Our very own IDPro member Tim Cappalli delivered key parts of the event, from the very first live cross device/vendor passkey demo to a very lively panel.   

Remaining in IDpro territory, mighty board member and acclaimed book author Jon Lehtinen presented a session on “Demystifying the Identity Capabilities of AWS for Enterprise Practitioners”- no one will be surprised to learn that it was well received.

Just because it’s RSA, and the RSA experience needs some “pure security” to be complete, I decided to attend “Bypassing Windows Hello for Business and Pleasure” –  and I wasn’t disappointed. The lengths to which the researcher had to go in order to defeat Windows Hello were substantial, and he presented his journey with flair and competence. If you have access to the on-demand content, I would recommend this session.

In Summary

Is RSA still worth the very hefty admission price? From the content perspective, I am honestly not sure. I got lucky with George and passkey, but the dearth of identity content is concerning, though I suspect part of the fault falls on ourselves – I personally had some submission fatigue and didn’t propose anything. Perhaps we should resolve to submit in bigger numbers and see whether we move the needle. From the experience perspective… I’d say it’s a resounding YES. True, we identirati have other opportunities to see each other, but with its sheer size, parties (rrrisky) and general vibe, RSA remains an important milestone in the conference calendar, and I am glad it’s back!

About the Author

Vittorio Bertocci is a Principal Architect for Auth0|OKTA. A veteran of the identity industry, in his 20 year career Vittorio helped create, shape and steer key identity products, technologies, and practices. Vittorio is currently serving on the OpenID Foundation board of directors, and is the host of the Identity, Unlocked podcast. An active member of the identity community, Vittorio is a well-known speaker, educator, and published author.

The post Strolling Through RSAC 2022 appeared first on IDPro.