Protocol practice· Zero Trust & Modern Identity Architecture Members
Shared Signals: tell every app a session ended, the moment it ends
Objective: When Harbor’s identity provider ends someone’s session, after a stolen laptop or a risky sign-in, the wiki keeps them signed in until its own session runs out, eight hours later. Subscribe the wiki to the provider’s CAEP events, check what arrives, and end the session the moment you’re told.
5 steps11 concepts 12 min
Where Shared Signals fitNot sure? Which protocol?
Who is this? · 5 labs
- OpenID Connect
- SAML
- Kerberos
- Device code
- Shared SignalsYou are here
What you’ll do
- 1Find out what the identity provider can send. Harbor’s identity provider, https://id.harbor.example, is a Shared Signals transmitter.
- 2Ask for the events the wiki needs. A stream is the subscription between one transmitter and one receiver: which events, delivered how, and where..
- 3Prove the stream works before you rely on it. Before a real event matters, the wiki asks the transmitter to send a verification event, with a value only the wiki knows..
- 4A session-revoked event arrives. At 14:02, Maya’s laptop is reported stolen and her session is ended at the identity provider.
- 5End the session, and refuse a forgery. Maya’s wiki session would otherwise last until 22:00.