Profile


Stream
John Bradley
Shared publicly -Based on feedback I have released a update of Encoding claims in the OAuth 2 state parameter using a JWT . Based on the first version Hans Zandbelt has added support in the OpenID Connect Apache module . People can test the IdP initiated flow with this. ...
John Bradley
Shared publicly -Nat, Mike & John Today the JSON Web Token (JWT) and JSON Object Signing and Encryption (JOSE)specifications were granted a Special European Identity Award for Best Innovation for Security in the API Economy. I was honored to accept the award, along with Nat...
John Bradley
Shared publicly -This is another interview that I did this week on the open redirector topic for Programable Web . I think the author sums up the issue nicely. Ultimately, the OpenID and OAuth security issue highlights the fact that implementation is everything. Open stan...
John Bradley
Shared publicly -I was interviewed Wednesday by Information week for an article on the Open Redirector issue. All in all it turned out not too bad. I am glad to know that Linked in set a deadline for their clients to register redirect_uri. The sites using Facebook Connect s...
John Bradley
Shared publicly -At the Internet Identity Workshop in California yesterday a number of the members of the IETF OAuth Working group met to discuss the open redirector issue. One design choice that was made years ago about fragment encoding the response for Java Script client...
John Bradley
Shared publicly -Based on feedback from IIW I have updated my draft, changing the name of the Cross Site Request Forgery Protection parameter from "xrsf" to Request Forgery Protection "rfp". Some were confused by the parameter name. (That is what first drafts are for.) I ...
- Ping IdentitySr. Technical Architect, 2012 - present
- Protiviti Government Services IncIdentity and Access Management Lab, 2010 - present
- CryptolexFederated Identity Standards, 2008 - 2010
- NDP, Cyberstore, Westel, Group Telecom
- Cogneto, OIDF, ICF
John is a Senior Technical Architect in the CTO Office of Ping Identity. He is an experienced IT professional with a diverse background. Most recently, John has been co-authoring the OpenID Connect protocol and JSON Object Signing and Encryption (JOSE) along with OAuth 2, He co-authord the ICAM protocol profiles while at Protiviti Government Services. He has also been coordinating interoperability testing on the profiles with OASIS and Trust Framework partners from industry. John provides leadership at Kantara as chair of the Leadership Council and as chair Federation Interoperability Work Group. He has contributed to SAML, openID, Information Card (IMI), XRI and other identity standards. He is actively working to develop the next version of openID. As the Co-Chair of OSIS he has both developed testing infrastructure and co-coordinated interoperability testing amongst all the major vendors participating in openID and Information Cards.
- openID Connect (current)
- Thread Safe (current)











