Loading…
October 25, 2022 | Detroit, Michigan
View More Details & Registration Information 

The Sched app allows you to build your schedule but is not a substitute for your event registration. You must be registered for KubeCon + CloudNativeCon North America 2022 - Detroit, MI + Virtual and add this Co-Located event to your registration to participate in these sessions. If you have not registered but would like to join us, please go to the event registration page to purchase a registration.

Please note: This schedule is automatically displayed in Eastern Daylight Time (EDT), UTC -4. To see the schedule in your preferred timezone, please select from the drop-down menu to the right, above "Filter by Date."

The schedule is subject to change.
Back To Schedule
Tuesday, October 25 • 3:30pm - 3:40pm
⚡ Lightning Talk: Security Considerations with Fulcio and OIDC JWTs - Zach Steindler, GitHub

Sign up or log in to save this to your schedule, view media, leave feedback and see who's attending!

Tweet Share
Feedback form is now closed.
Fulcio relies on OIDC JWTs to authenticate requests, as well as providing information about the build environment if the OIDC provider supports it. This is great, as it allows trust between systems without having to manage long-lived API keys, but there's security considerations to be aware of as you use these JWTs. Specifically, we'll go over what data is sent when interacting with Fulcio and Rekor, why it's good to customize the audience when you request a JWT from your OIDC provider, how to approach validating fields, and things to look out for if you find yourself writing code to validate JWTs.
Speakers
avatar for Zach Steindler

Zach Steindler

Security Engineer, GitHub
Zach is in the middle of building a chicken coop, and is slowly learning more about gardening. When he's at the keyboard he likes working on home automation, civic projects, and helping secure open source software. A housing inspector once called his electrical work "amateurish... Read More →

Security Considerations with Fulcio and OIDC JWTs pdf
Tuesday October 25, 2022 3:30pm - 3:40pm EDT
Room 430 A
  Lightning Talks