apidays Paris 2024 - Reconciling Zero-Trust APIs and Developer eXperience, Romain Quinio and Kevin Viet, Amadeus

Reconciling Zero-Trust APIs and Developer eXperience
Romain Quinio, Lead Principal Engineer at Amadeus
Kevin Viet, Lead Principal Engineer at Amadeus

apidays Paris 2024 - The Future API Stack for Mass Innovation
December 3 - 5, 2024

------

Check out our conferences at https://www.apidays.global/

Do you want to sponsor or talk at one of our conferences?
https://apidays.typeform.com/to/ILJeAaV8

Learn more on APIscene, the global media made by the community for the community:
https://www.apiscene.io

Explore the API ecosystem with the API Landscape:
https://apilandscape.apiscene.io/

Transcript

1. © Amadeus IT Group and its affiliates and subsidiaries Reconciling Zero-Trust APIs and Developer eXperience Romain Quinio Kevin Viet
2. © Amadeus IT Group and its affiliates and subsidiaries 1. Broken Object Level Authorization 2. Broken Authentication 3. Broken Object Property Level Authorization 4. Unrestricted Resource Consumption 5. Broken Function Level Authorization
3. © Amadeus IT Group and its affiliates and subsidiaries We connect the travel ecosystem Amadeus. It’s how travel works better. 3 Romain Quinio Kevin Viet rquinio rquinio vietk vietk Lead Principal Engineer Lead Principal Engineer
4. © Amadeus IT Group and its affiliates and subsidiaries Agile hardware & software Transformation: zero trust & secured APIs • Public cloud: Defense in depth to protect against potential attackers because IaaS/PaaS can be compromised • Microservice architecture: Loosely coupled services that need to implement security requirements  Who is responsible for security requirements? 4
5. © Amadeus IT Group and its affiliates and subsidiaries Identity provider Secured APIs in the cloud Frontend JWT Travel Search JWT 5
6. © Amadeus IT Group and its affiliates and subsidiaries How to test a secured API? Component Dev Mode Local dev Production Integration Mock OIDC protocol? Use containerized OIDC provider? Use production OIDC provider? Enable security Disable security 6 Containerized mock
7. © Amadeus IT Group and its affiliates and subsidiaries Microcks Secured APIs in dev mode Quarkus Swagger UI JWT Travel Search JWT 7
8. © Amadeus IT Group and its affiliates and subsidiaries Demo 8
9. © Amadeus IT Group and its affiliates and subsidiaries Key takeaways Shift-left Zero trust APIs • Avoid design choice to workaround security • Test security requirements as early as possible • DevSecOps mindset – Security becomes the responsibility of the developer, not “application security” team. Developer eXperience: treat OIDC as any other API • Consider same mocking tool in all phases, thanks to containers • Microcks example: https://github.com/microcks/microcks- quickstarters/tree/main/oidc/example.com 9