Confirming Safety of IAM Specifications and their OSS Implementations - Keycloak as a Case Study

Explore comprehensive security verification methods for identity and access management systems in this 42-minute conference talk from the Linux Foundation's Open Source Summit. Learn how to ensure the safety of IAM specifications like OpenID Connect 1.0 and OAuth 2.0, and verify that their open source implementations are secure and compliant. Discover three critical verification approaches: formal analysis for specification safety, conformance testing for correct implementation, and vulnerability testing for specification-specific security issues. Gain practical insights through a detailed case study of Keycloak, the CNCF incubating identity and access management project, examining how its implemented specifications are verified for security and compliance. Understand how to apply these verification methods to evaluate the security of IAM products you use or develop, with explanations designed to be accessible to developers who may not be familiar with formal security analysis techniques.