Annabelle Backman
- Editor of RFC 8935 and RFC 8936, push and poll delivery for Security Event Tokens
- Co-chair of the OpenID Shared Signals and Events working group
- Co-author of the RISC profile and event-type specifications
Bio
Annabelle Backman is a principal security engineer on AWS Identity and co-chairs the OpenID Shared Signals and Events working group. She edited RFC 8935 and RFC 8936, the push and poll delivery mechanisms for Security Event Tokens, and co-authored the RISC profile and event-type specifications built on them.
Profile built from public IETF and OpenID Foundation records.
Where their work shows up
CAEP and RISC describe what one identity system should tell another when something changes. The delivery RFCs are the unglamorous layer that makes that actually work across organizations: how a transmitter and receiver establish a stream, how events are acknowledged, and what happens when a receiver is offline. Without agreed delivery, cross-domain signals stay a vendor feature. See refresh token abuse, session cookie theft, and the ITDR guide.
Related on Start with Identity
- GlossaryAccess Token
A short-lived credential a client presents to a resource server to access protected data. Access tokens are typically opaque or JWT-formatted, with lifetimes me
- GlossaryAgentic Identity
Identity for autonomous AI agents that act on a user's behalf, call APIs, and chain tools. Requires scoped, delegated, auditable, and revocable credentials rath
- GlossaryAuthorization Code Flow
The recommended OAuth 2.0 flow for apps with a user: the app receives a short-lived code, then exchanges it for tokens from a back channel. Combined with PKCE f
- CVEDrupal Simple OAuth/OIDC auth bypass via an alternate path
Drupal Simple OAuth / OIDC 6.0.0 through 6.0.6 allowed authentication to be skipped on an alternate path. Patched in 6.0.7.
- CVEDuende OAuth token management mixes tokens across requests
A race in Duende's .NET OAuth token-management package could attach client A's token to client B's request. Session mix-up, not a crypto break, but it is still
- CVEOAuth 2.0 private_key_jwt audience ambiguity
A specification-level flaw in the OAuth 2.0 JWT profile: private_key_jwt audience is ambiguous, so a token minted for one authorization server can be accepted b