How Does a Workload Authenticate an API Request?: Implementing Transaction Token...
summary
Implements the IETF Transaction Tokens draft using Keycloak as both authorization server and transaction token service by adding a custom Keycloak Token Exchange SPI that issues short‑lived JWT transaction tokens (claims: aud, req_wl, purpose) via RFC8693 token exchange. Demo runs on minikube with Spire providing JWT SVID proof, frontends and backend validate audience, requesting workload and purpose, and the build shows one frontend request succeeds while the other is rejected (front-end1 success, front-end2 rejected).
AI-written summary · about
chapters (13)
- 0:00Workload authentication basics
- 2:04Challenges in API auth
- 6:03Transaction tokens intro
- 9:18Transaction tokens benefits
- 9:39Keycloak overview
- 11:44Keycloak token setup
- 14:16Client auth methods
- 15:25SPIFFE identity verification
- 17:14Demo environment setup
- 19:07Live demo setup
- 29:42Transaction token workflow
- 36:16OPA auth results
- 37:00Conclusion & Q&A
related talks
25mBridging the Gap Between Human and Workload Identity: SPIFFE Support in Keycloak
29mSecuring Workloads with Transaction Tokens and Minicloak
34mThrow Away Your Passwords: Trusting Workload Identity
36mSecuring Agentic Platforms with Zero-Trust Workload Identities
24mA Token Walks Into a SPA
29mKnock knock, who's there? Authenticating your single page apps using JSON Web Token
04mProject Lightning Talk: How to get your custom access tokens from Keycloak
29mWorkload Identity for Humans: A Twelve-Factor Approach