Annabelle Backman
- Editor of RFC 8935 and RFC 8936, push and poll delivery for Security Event Tokens
- Co-chair of the OpenID Shared Signals and Events working group
- Co-author of the RISC profile and event-type specifications
Bio
Annabelle Backman is a principal security engineer on AWS Identity and co-chairs the OpenID Shared Signals and Events working group. She edited RFC 8935 and RFC 8936, the push and poll delivery mechanisms for Security Event Tokens, and co-authored the RISC profile and event-type specifications built on them.
Profile built from public IETF and OpenID Foundation records.
Where their work shows up
CAEP and RISC describe what one identity system should tell another when something changes. The delivery RFCs are the unglamorous layer that makes that actually work across organizations: how a transmitter and receiver establish a stream, how events are acknowledged, and what happens when a receiver is offline. Without agreed delivery, cross-domain signals stay a vendor feature. See refresh token abuse, session cookie theft, and the ITDR guide.
Related on Start with Identity
- GlossaryAccess Token
A short-lived credential a client presents to a resource server to access protected data. Access tokens are typically opaque or JWT-formatted, with lifetimes me
- CVEAD FS elevation of privilege exploited as a zero-day
A low-privileged local user on an AD FS server could become administrator on the box that holds the federation token-signing keys. Microsoft saw exploitation be
- GlossaryAgentic Identity
Identity for autonomous AI agents that act on a user's behalf, call APIs, and chain tools. Requires scoped, delegated, auditable, and revocable credentials rath
- PodcastAuth0
The late Vittorio Bertocci's interviews with the authors of OAuth, OpenID Connect, FIDO, and SAML. Ended in 2022, and still the best audio archive on identity s
- GlossaryAuthorization (AuthZ)
Authorization (AuthZ) is the decision to permit or deny an authenticated subject access to a resource or action, and the rights that result; NIST's glossary, ci
- CVEDrupal Simple OAuth/OIDC auth bypass via an alternate path
Drupal Simple OAuth / OIDC 6.0.0 through 6.0.6 allowed authentication to be skipped on an alternate path. Patched in 6.0.7.