Episode 251 - GluuFederation/identerati-office-hours GitHub Wiki
Title: Continuous Authorization: Beyond the Login Event
- Host: Mike Schwartz, Founder/CEO Gluu
- Guest: Damodhara Palavali, Software Engineer, Social Security Administration
Channels
Description
Most enterprises still treat authentication as a one-time gate: verify the user, issue a session, and trust it until it expires. Zero Trust asks for more. But many environments include multiple identity providers, federated partners, and legacy applications that were never built to re-evaluate access mid-session. This session looks at what continuous authorization looks like in practice. Which signals are worth acting on: device posture, behavioral and risk signals, session context? How do standards like the OpenID SSF and CAEP carry those signals between providers and relying parties? Where should policy decisions should live? We'll also look at the hard parts: retrofitting legacy apps, avoiding friction for users, and the false-positive problem.
Homework
- NIST SP 800-207 Zero Trust Architecture
- OpenID Shared Signals Working Group
- CISA Zero Trust Maturity Model
Takeaways
- ⚡
- ⚡
- ⚡
- ⚡