"OAuth 2.0 and OpenID Connect (OIDC) are the most commonly used solutions for stateless, token-based authentication in distributed Microservice architectures as of today. You might already know the basic concepts of OAuth 2.0 and OpenID Connect. But have you ever asked yourself how to really implement this practically for Microservices using a well-known framework like Spring Security? Then this workshop is a good opportunity to get to know how it works by making your hands dirty in code. After a short recap for the basic concepts of OAuth 2.0 and OpenID Connect, we will use a Spring Boot based Java application to gradually implement authentication and authorization using these standards. Learning Objectives: - The detailed procedure of the Authorization Code Grant protocol flow - Implementation of an OAuth 2.0/OIDC compliant Resource Server - Implementation of an OAuth 2.0/OIDC compliant client - Automated testing with OAuth 2.0 and OpenID Connect Prerequisites: Basic experience in Java is expected. For the hands-on part, a notebook with at least JDK version 11 and any Java IDE installed is required."

A joint workshop by the OpenID Foundation and Open Banking Implementation Entity on Conformance and Certifications. => Welcome & Introduction * Intro to OpenID Foundation * Intro to Open Banking Implementation Entity * Why conformance and certification is critical to ensuring standards are secure and interoperable Don Thibeau (OIDF) Chris Michael (OBIE & Session Host) => Introduction to OpenID Connect and Financial-grade API (FAPI) * OpenID Connect overview * Introduction to Financial-grade API (FAPI) * Vision for the FAPI profile and conformance tools in a global context => Detailed Overview of the FAPI and CIBA Profiles Including Enhanced Security in New Versions * High level functionality of latest drafts of FAPI and CIBA * The extra security in FAPI-RW 1.0 and FAPI 2.0 * Future planned updates Nat Sakimura (OIDF) Dave Tonge (OIDF & Moneyhub) => Introduction to the OBIE Standard * Summary of Functional APIs and DCR * Different approaches to use of OBIE * Directory and eIDAS certificate validation Freddi Gyara (OBIE) => Standards, Security & Interoperability Discussion * The security advantages of the OB directory model vs eIDAS * The apparent conflict between security and interoperability, especially in bank environments Dave Tonge (OIDF & Moneyhub) Freddi Gyara (OBIE) => How Certification Programs Attempt to Ensure Both Security and Interoperability: Demonstration of the OpenID Conformance Test Suite * Overview of self-certification * Examples of security & interoperability checks the suite does on OAuth2 & OpenID Connect * Architecture / extensibility / applicability to further protocols * Future roadmap * Demo of the conformance test suite including App-App tests & RP tests Joseph Heenan (OIDF & Fintech Labs) => How Certification Programs Attempt to Ensure Both Security and Interoperability: Demonstration of the OBIE Conformance Tool * For AIS, PIS, CBPII and DCR * Examples of security & interoperability checks Glyn Jackson (OBIE) & Julian Coombes (OBIE) => Q&A Session on OIDF & OBIE Specifications & Conformance Tools Don Thibeau (OIDF) Chris Michael (OBIE) => Open Audience Discussion on Issues and Suggestions * Getting other jurisdictions engaged * Global open banking initiatives * What can OIDF & OBIE do to help? Don Thibeau (OIDF) Chris Michael (OBIE)