Advancing Machine to Machine Workflows with the SPIFFE Identity Provider
summary
Shows how Keycloak v26.4.0 uses federated client authentication to accept workload identities issued by SPIFFE/SPIRE, using a SPIRE agent + server, Toria for management, and a spiffe-helper sidecar + CSI driver to mount tokens. Demonstrates replacing client secrets with client assertion JWTs (SPFFE assertion type) from Kubernetes workloads (example namespace tiklocon), with SVID lifetimes set to 5-minute SVID and automated client bootstrapping for scoped, short‑lived machine identities. Also notes Quarkus integration and that the feature is currently a tech preview.
AI-written summary · about
chapters (16)
- 0:00SPIFFE and SPIRE intro
- 2:25Cloud security evolution
- 6:17API keys limitations
- 7:00SPIFFE workload identity
- 12:41Keycloak federated auth
- 15:33Demo setup overview
- 18:44SPIFFE future integration
- 19:58Live SPIFFE Keycloak demo
- 22:03Q&A client registration
- 23:30Comparing SPIFFE with mutual TLS approaches
- 24:33Trust domain strategies
- 26:19SPIFFE credentials performance
- 27:22SPIRE management HA
- 28:04SPIFFE identity validation
- 29:09K8s service account benefits
- 30:17Conclusion
related talks
36mFederated Identity for Distributed Systems: Understanding SPIFFE
36mSecuring Agentic Platforms with Zero-Trust Workload Identities
36mIntroducing SPIFFE: An Open Standard for Identity in Cloud Native Environments [I]
30mIntro: SPIFFE
29mBridging the Great Divide: SPIFFE/SPIRE for Cross-Cluster Authentication
40mMulti-Cloud Workload Identity With SPIFFE
36mSPIFFE: In Theory and in Practice
49mReal World SPIFFE Scenarios and Outcomes