Qiita - 人気の記事RedmineのネイティブOAuth2でAIエージェントに安全にRedmineを操作させる
https://qiita.com/ssc-ksaitou/items/b7a4d51ed78fa6e45521?utm_campaign=popular_items&utm_medium=feed&utm_source=popular_items
IAMDevBoxThe IETF just published a framework for AI agent identity. AIMS composes SPIFFE, WIMSE, and OAuth 2.0 into an 8-layer model that replaces static API keys with proper workload identity. 53% of MCP servers still use API keys — this changes that.
Stefan BohacekAny fediverse developers with too much free time on their hands interested in helping me figure out why, when logging in with a Friendica account, I get an "Unprocessable Entity" error?
Hummingbird SecurityEvery time someone on your team connects an AI tool to their work account, a new OAuth identity gets created in your environment.
It doesn't expire when the tool stops being used. It doesn't get caught by standard offboarding. It just persists, holding access nobody's monitoring.
In most orgs, NHIs like these outnumber human ones. Most were never inventoried.
Visibility is step one. Auth Sentry Monitor is free:
gethumming.io/Monitor/
BIツールの進化先？！ DBを業務分析用のMCPサーバにしてBIを次世代にする
https://qiita.com/ssc-ksaitou/items/784cd48a88e4ab166f69?utm_campaign=popular_items&utm_medium=feed&utm_source=popular_items
Grafanaの管理者って6種類あんねん【Cognito連携】
https://qiita.com/melknzw/items/63d33ed4b6fe9fe9a922?utm_campaign=popular_items&utm_medium=feed&utm_source=popular_items
jandi@researchbuzz Good luck!
I see some OAuth labeled bugs in the repo: https://github.com/goauthentik/authentik/issues?q=is%3Aissue%20is%3Aopen%20oauth%20label%3Abug
I'm adding some tags, just in case #OAuth #Patreon #FediHelp ⬆️⬆️⬆️
chfkch 
So i am thinking out loud:
In the past i wanted to create an identity system, where the users could create sets of personal data like phone number(s), email adress(es), bank account(s) and physical adress(es) etc.
Then they could share grants, which are like an access control for a specific subset of those.
Could this be realised with private claims from OAuth?
Example in the next posts.
#OAuth #IdentityManagement
In the past i wanted to create an identity system, where the users could create sets of personal data like phone number(s), email adress(es), bank account(s) and physical adress(es) etc.
Then they could share grants, which are like an access control for a specific subset of those.
Could this be realised with private claims from OAuth?
Example in the next posts.
#OAuth #IdentityManagement
John Gordon 📷I hate it when people think OAuth is the only way to do things. Fine, it you are a web app running in a browser and using a third party service where your users don't want to let you see their credentials.
But, for a first party CLI app, perhaps making me copy & paste a four line URL, then log in on a different machine and copy back a long token string isn't the best option.
Also, don't put a 15 second time limit on an operation like that. #AI #Claude #FAIL #OAuth
Erik C. ThauvinDPoP: What It Is, How It Works, and Why Bearer Tokens Aren’t Enough
#bearer #cryptography #dpop #java #oauth #security #token
https://foojay.io/today/dpop-what-it-is-how-it-works-and-why-bearer-tokens-arent-enough/
