OpenID

So we actually don't have it yet, but it will be there soon.

In actually the next major release, we are adding full OAuth, you know, OpenID, OEDC, SAML into Unimus as well.

So, yeah.

Now, it sounds like because you support MCP, I, as a customer, could bring my own model or agents.

And then probably in 2005, I got pulled into the Liberty Alliance, which was building identity web services frameworks on top of SAML and WSTAR, sort of in response to an effort Microsoft had going on at the time to sort of like assign every person a single identifier and they would manage it for you, which the privacy people decided was not the greatest solution.

And it sort of just snowballed from there, getting involved in OpenID 1, OAuth 1, OAuth 2, OpenID 2, OpenID Connect, and many follow-on specs after that.

So that's a pretty good history of kind of how things got into it, I guess.

What was the thing that's like, oh my gosh, we have to do something about this?

You have European regulation called ADAS in Europe.

You have OpenID.

So basically kind of, and W3C, like all of the organizations that develop standards either for identity or for the internet have kind of... worked together for the past decade to enable a new generation of standards for digital IDs that you can use to prove who you are on the internet.

So that's something that is happening.

There is a better way to do that.

It's called OIDC, OpenID Connect.

And the idea here is that you would do like web federation.

So you could create a role that will have a trust policy that would allow GitHub to present its credentials, like I'm GitHub.

So that's like, it's very simple explanation, but that allows you to avoid static credentials.

So your workers will be able not to have any secrets that you share with them.

They just need to be running on GitHub, and then the GitHub's identity, this is what allows AWS to establish trust through OpenID.

Nice and dandy.

Can you double click on, you know, your core of the idea? Because you're talking about a global standard, right? Like you by yourself, like you can come up with a way to do it.

But you cannot set the standard, right? So is there a global standard being set, just like we had for OpenID and SSL authentication? There are authentication standards, right? So is there a governing body that is global, that is accepted? So is there now a global standard for agent trust and authentication? And, you know, are you a contributor? Who else is there as a contributor? And how good is it that it can now officially become a global standard?

And, you know, that's the billion dollar question, right? Because it is actually, I take that back.

That's a multi-trillion dollar question.

A node on security, same thing, there we go.

A node on security, GeoNode integrates with OAuth and OpenID and your own security system's already in place.

There's also GeoFence, which adds on to allow for granular data access and permission settings between jurisdictions are based on data sensitivity.

A note on GeoSolutions, we've been building, maintaining, and developing applications for open source for over 20 years now.

how to enable access securely between the LDAP-connected applications and the Active Directory-connected applications.

And so things like SAML and OpenID Connect came along, and we ended up standardizing those across the enterprise.

And, you know, it just kind of things took off from there, really.

And it just, identity itself in the industry, in the security industry, ended up being elevated in importance.

And we, again, we've been consolidating a lot of authentication activity into Entra over the past couple of years.

And So there was a lot of that interaction where we had to work with app teams and ease them off of dependencies of weaker auth methods, even just transitioning from on-premise based auth.

They were still doing binds to the directory and things like that, that we had to ease them off of that and get them using cloud auth methods, you know, using OpenID connected SAML.

Nice.

And then you have to think about, you know, what transaction tokens which help you in securing the call chain.

And then look at OpenID's Authzwork for policy specification.

And then there's more around agent control plane, which is agent control standard that's coming up now soon.

So all of this c- as an enterprise owner, you have to look at all of these standards together, and all of these are trying to address those gaps which are not in the current code.

I would, um-- But if you haven't read the IETF draft on AI agent authentication and authorization, I would highly recommend reading that one because it just tries to cover everything at once.

That's a really good starting point.

And then you should definitely look at OpenID's AuthZ work and Shared Signals Framework work for continuous access evaluation protocol.

I'm throwing a lot of words here.