Skip to content

SPIFFE Meets OAuth: Federated Identity for Cloud Native Workloads#

KubeCon + CloudNativeCon Europe 2026 digest Program Adjacent pick 23–26 March 2026

Abstract Recording

Yoshiyuki Tabata, Hitachi, Ltd.

Play the recording: SPIFFE Meets OAuth: Federated Identity for Cloud Native Workloads

  • Why: Addresses the multi-hop authorization problem across trust domains, which is where mTLS-only designs tend to run out of road. Cites specific drafts and RFCs rather than gesturing at "zero trust".
  • What: Federated identity patterns combining SPIFFE with emerging OAuth extensions, for propagating identity and authorization across trust domains.
  • How: SPIFFE JWT-SVID plus OAuth Identity Chaining (draft-ietf-oauth-identity-chaining) and the Assertion Framework (RFC 7521 / 7523), enabling multi-hop authorization and identity propagation without relying solely on mTLS. Demo integrates Keycloak, SPIRE and OAuth flows.
  • Where applicable: Multi-cluster and multi-trust-domain estates. General technique built on public standards; the demo stack is one instantiation.