Tag

#oidc

Tagged “oidc”

11 articles

GTIG's agentic threat report is a CI/CD problem, not just an AI problem

Google's Threat Intelligence Group documents DUSTMAKER, an OIDC-stealing supply-chain payload from UNC6780 that ships valid SLSA Build 3 attestations. The moment a signed provenance line stops being a defence is the moment CI/CD owners have to rethink runner trust.

Sep 10, 2026 · Tomás Vega Access & identity

The kubectl client secret CNCF wants you to stop distributing

A CNCF blog post argues that the 'confidential' OIDC client most on-prem clusters use for kubectl is a shared static credential in disguise, and that a public client with PKCE is the honest fit for a CLI that lives on every operator's laptop.

Sep 9, 2026 · Tomás Vega Identity and access

Azure DevOps opens a Service Connection off-ramp from PATs and build session tokens

A preview from Microsoft DevOps lets Azure Pipelines authenticate against Azure DevOps with an Entra-backed Service Connection instead of a Personal Access Token or Build Session token. The coverage is scoped: repo resources, YAML template checkouts, NuGetAuthenticate, InvokeRESTAPI and the AzureCLI task.

Aug 15, 2026 · Maya Okonkwo Security & supply chain

Docker Hub gets OIDC federation for GitHub Actions, retiring the PAT-in-a-secret pattern

Docker has added OpenID Connect authentication for GitHub Actions on Team, Business and Docker Hardened Images plans, so workflows push and pull images with a short-lived per-run token instead of a stored Personal Access Token. It closes off one of the last static credentials still sitting in most Actions repos.

Aug 1, 2026 · Maya Okonkwo Security & supply chain

npm walls off 2FA-bypass tokens from account and package management

As of July 31, npm granular access tokens configured to bypass 2FA can no longer perform sensitive account, organisation or package management actions. Those calls now demand an interactive 2FA challenge, and the same tokens are on a January 2027 timer to lose direct publish rights too.

Aug 1, 2026 · Tomás Vega Security & supply chain

GTIG and Mandiant publish a supply-chain hardening playbook aimed at CI/CD teams

Google's Threat Intelligence Group and Mandiant have released a joint guide on defending against software supply chain compromise, mapping four control categories onto the concrete pipeline levers most teams already own: short-lived tokens, ephemeral runners, package cooldowns and dependency verification.

Jul 30, 2026 · Tomás Vega Security & supply chain

Auditors, OIDC and the trust policy most teams get wrong

A DevOps.com walkthrough by Artur Yolchyan lays out a SOC 2-shaped CI/CD pipeline on GitHub Actions and AWS: multi-account isolation, OIDC federation locked to one repo and branch, and the same container image retagged all the way to production. The interesting part is not the account topology; it is the one line in the trust policy that decides who can talk to your ECR.

Jul 24, 2026 · Tomás Vega Security & supply chain

The npm worm that shipped with valid SLSA provenance

A DevOps.com analysis of the Miasma npm worm makes an uncomfortable case: signing and provenance told the honest truth, and the pipeline still shipped malware. When the build platform itself is the attack surface, a green attestation is a description of the failure, not a defence against it.

Jul 22, 2026 · Tomás Vega Identity and access

Anthropic swaps per-developer Claude Code secrets for an OIDC gateway

Anthropic shipped a self-hosted Claude apps gateway that runs Claude Code on Amazon Bedrock and Google Cloud without per-developer cloud credentials, federating identity through Google Workspace, Microsoft Entra ID, Okta or any standards-compliant OIDC provider.

Jul 5, 2026 · Tomás Vega Security & supply chain

Azure DevOps issuer in WIF service connections heads for July 2027 retirement

Microsoft has set July 1, 2027 as the retirement date for the Azure DevOps issuer in workload identity federation service connections, pushing Azure Pipelines that already moved to secretless auth onto the shared Microsoft Entra issuer over the next year.

Jun 22, 2026 · Maya Okonkwo Security & supply chain

GitHub Agentic Workflows drop personal access tokens for the built-in Actions token

Agentic workflows on GitHub can now authenticate with the ephemeral GITHUB_TOKEN instead of a long-lived personal access token. It is a quiet credential-hygiene win that closes one of the messier blast radii in agent-driven CI.

Jun 15, 2026 · Tomás Vega