So there are three things that are guaranteed to happen in life one It's always gonna be annoying to have to wake up early in the morning two You're gonna have to pay taxes and three when Ravens wants some money They're gonna go straight to Brandon Williams contract So YouTube team keep it clean. What's going on? Happy Purple Friday It's been a long time since we said that it feels like it's been years since we said that but it's only been like six Seven months, but anyway, happy Friday. Hope y'all are doing good. Hey, shout out to all of y'all that checked out the podcast man The the link to the podcast on anchor on Spotify and on YouTube is down below in the description So I know some people say oh, I don't have anchor I don't have Spotify you can still listen on either one But you can also listen to it on YouTube now because I have the YouTube channel for it That's gonna have all the episodes up on there as well. So make sure you subscribe to that But anyway The Ravens they they reworked Brandon Williams contract yet again So we're gonna talk about exactly what this means. Let's let's see the tweet straight from field Yates He said the Ravens and defensive tackle Brandon Williams recently agreed to a reworked contract That includes 8.25 mil guaranteed with a base value of 15.75 mil over the next two years Previously he was do 19 mil over the next two years with no guarantees Baltimore gains three mil and cap space for the in the move So His his contract became guaranteed It says 8.25 mil guaranteed with a base value of 15.75 mil over the next two years. So what does this mean? they have reworked his contract yet again and Contrast contrary to what I thought and what I thought was gonna go down this offseason a lot of other people too Brandon Williams ain't going anywhere He's not going anywhere. That's what happens when you rework contracts when you redo contracts Especially Brandon Williams contract because I like I said earlier man every time man It seems like it happens if not every year than every two years They always rework in Brandon Williams contracts some of the contracts. They would always go to will be Brandon Williams and Jimmy Smith Because they signed them to they had signed Jimmy Smith to that four year 40 million dollar deal They used to always rework it too, but Brandon Williams over everybody They would go straight to him first, but this this says that he isn't going anywhere Now I'm not sure if it's in a question from subscriber video that we're gonna be putting out today Or a question from subscriber video that we put out yesterday But we talked about Brandon Williams and how we expected the Ravens to move on from Brandon Williams Not because he's a bad player at all because he's a really good player is great at what he does but simply because I just felt like due to the salary and Then wanting to get more versatile on the defensive line I thought they will move on from Brandon Williams, but this lets us know. Ah, nope ain't happening But another thing that it lets us know because you don't just do these moves for nothing You don't just create three million cap space for nothing. I And my personal opinion Could be wrong. We'll see Because the Ravens they currently have think they have about 12 million salary cap space But once Earl Thomas files his grievance, they're gonna only have seven million again So if this creates three meals, so they'll have about they should have about 10 million cap space after this move It tells me that they are looking to bring somebody in That's what it's saying to me could be wrong, but I don't think they usually carry about five meal throughout the season for insurance money for just in case money But it seems to me as if either they're gonna bring somebody in or they are going to be Extending somebody's contract coming up very very very very very soon and If I had to guess as far as who they're bringing in no clue don't know But as far as whose contract they could possibly extend Ronnie Stanley That would be a candidate I would I would that would be my first guess It could be No, yeah, I don't really think it would be anybody else. I think it would be just Ronnie Stanley could be somebody else You know Ravens, but they'll pull something out of a hat They'll do some crazy surprise. Well, it's like oh, I didn't see that coming. Oh, I didn't know they were gonna do that Happens every time and Ravens always doing some they always up to some sneaky stuff always man, but I Don't know how it's gonna end up man. I don't know who it's gonna be I I don't know what they're gonna do But them clearing up this cap space does indicate that they have a move that they want to make Whether it's extending their own or bringing in somebody else to become one of their own now if if they were bringing in somebody One of the positions some of the positions that I could see it happening yet Would be past rush Because obviously with the whole Jadavion Clowney thing, you know, obviously with the whole Yannick and Godway thing I could see it there Now what options are out there because I really don't think Clay Matthews is gonna be it Because I know a lot of people have talked about hey Maybe they should bring in Clay Matthews bring in Clay Matthews and the whole story came out yesterday First Adam Schefter said that Clay Matthews said he wasn't gonna play this year and Clay Matthews quote tweeted Adam Schefter He shut all that down. No, I didn't say that I never said that my agent never said that we ain't say that I Said that I'm not playing for the Broncos because we try to come to an agreement couldn't come to an agreement I'm not gonna play for them never said I wasn't gonna play So I was like, okay, okay Clay Clay. I see you man But I don't think it's gonna be Clay Matthews There's been some talk about Ziggy answer. I um, I Don't think it's gonna be him either. I really do believe because and and I Really do believe that if Ravens get a pass Russia, it will be via trade And the reason I say I don't think it'll be a free agent is because they haven't signed one yet Now one of the reasons and shout out to my god Mike B Because he had actually showed me something that it made a lot of sense that one agent said I forgot what her name was, but she's an agent for some different players in the NFL and She's talked about why some of your favorite players are still free agents And it's something that we knew and and we've talked about a little bit on here But it was nice to have that reminder and she mentioned how the NFL has termination pay But with termination pay for veterans If they got Terminated and and they were on a on a week one roster then you would have to pay them termination pay But if you sign somebody after week one They said the salary for the entire season is not guaranteed and you don't have to pay them any termination pay So that means if you sign somebody after week one they come on your roster and they like on a week-to-week basis And you ain't got to worry about pay if you cut them. That's it. You're done No guarantees none of that you're done. So she said that she expects a lot of activity And after weeks one During like weeks two and three she expects a lot of people to get picked up and whatnot, but see with that This is why I don't think the Ravens are necessarily gonna be part of a big free agent pickup because They wouldn't need much salary cap space to pick up a free agent after week one because the salary is not guaranteed So that's why I say if if they are getting a pass rusher then I would think that it would be via trade Because they again, they always show and I know a lot of people got frustrated Which I can understand but that that these trades didn't go through but at the same time You got a you got to love it that Eric the cost is always trying always trying Always this guy doesn't stop We love it and a lot of people they liken it to what people playing Madden People trying to build Madden rosters. That's what the cost of does That's what he's done and it's tenor as a GM That's what he's been trying to make Madden rosters because he's trying to get this guy and that guy and that guy and that guy He's always trying for something So you got to give him credit for that got to give the front office credit for that they keep on trying But who they gonna try for next We'll see if I had to lean to one side I Would I would say they would be trying to keep one of their own and just do a big extension so they the extension may be one of them extensions that It takes up it takes a little nice little chunk of change right now And that's why they just try to create a little bit more salary cap space So I would I would think it would be Ronnie Stanley I would think it'd be it would be him because I think maybe Maybe the reason I think it could be Ronnie Stanley would be because they may have watched the game last night It's all that Texans offensive line and they'll probably watch and learn me tonsil and they're like he's good but Ronnie Stanley you better and We don't want Lamar to be looking like the Sean Watson was looking last night. Oh, that was rough. Oh big yikes That was so rough So if I had to lean to one side I would think that they would be getting ready to extend Ronnie Stanley But we should know very soon since the Ravens made this move. So they're gonna have the counter move Soon enough. Anyway teamkeeper clean appreciate y'all. I love y'all so much. Make sure you check out the podcast The link for it is in the description And I'm out


arfis ke tunas ke pehle, hamaara e pryas rahega ki samagra des naksal wad ki chapejt se moktho ho jayano. fourth war the acknowledging given the good ideas we got. During our primary phase we read some literature that we wanted to learn and that was byligh the Bisien division team. In the time before we make it we had to come on ideas from these attempts and came with CRPF or any other security forces and they were able to attack. So it was Centree and at that point Anand Funhn had started against us. Out of which seven to eight gelatin basics and detinatorsic and non-electronic ну let's use de-allekit겠습니다 we did


and welcome to the call. Thank you for joining me today. My name's Peter Finales. I'm a principal developer advocate with your zero product unit here at Okta. And today I am joined by my colleagues, Tim and Pradeepa. I'm gonna tell you a little bit about me very quickly so you know who I am and then I'm gonna hand it over to my colleagues. They're gonna tell you a little bit about themselves. Basically, I'm an architect, consultant, engineer. I have more than 30 years experience at developing software and working in the industry. And when I'm not helping teams with the complexities and values of securing software and security systems and security principles, you can usually find me engaged in either acting or directing a show at my local theater. So that's a little bit about me. I'm gonna hand over to Tim. Tim's gonna tell you a little bit about himself. Hi all, yeah, good morning everyone. I'm Tim. I'm the tech lead for AWS in EMEA. I'm for over three years now with Okta and for over 10 years in the identity space. When I'm not working, you can find me chasing my big dream to travel to every country in the world. So far, I've been to over 100 countries and I handed over to Pradeepa. I'm Pradeepa. I'm a staff developer advocate at Okta for the OZIL product. I've around 15 years of experience developing softwares and architecting solutions. This is my first year at Okta. So when I'm not working, I usually find me reading and going for an order walk, but that has changed a lot after I had my twin daughters last year. Mostly I don't have any free time and if I find free time, I'm usually sleeping. That's all about me. Thanks, Peter, for the introduction. Thank you, Pradeepa. Next slide, please. So just before we start, we've got a little terminology slide here. We're going to explain a lot of these things as we go through the presentation, but this one's just here for a refresher for those folks who watched the video afterwards and also who might look at the slide deck as well. So it's a little bit about the terminology and a little bit of explanation on there. And if we could get to the next slide, please, Pradeepa. Then we're going to do... This is the agenda for today. So we're going to get a little bit of information here about what's coming up. And so without further ado, I'm going to hand over to Tim, who's been taking us through our first section of What Is For Zero? Yeah, fantastic. So what is Art Hero? Well, we've all heard the expression that every company is a software company, but with the explosion of products and services, in reality, every company is becoming an experience company. And we as a consumer, we want to have an experience like with buying on Amazon or watching a movie on Netflix. So organizations want to differentiate the products that they develop and the services that they provide. So it all comes down to user experience. And this is where Art Hero as a cloud platform to manage the user identities comes into play. Our goal with the Art Hero platform is to optimize digital experiences by creating frictionless, contextualized, and secured user journeys while providing the developers a flexible and very easy to use platform that is extensible and secure. On the next slide, we can see how the high level architecture of Art Hero looks like. The user journey starts on the right hand side where we have the user identity. And typically you have one or multiple web portals, smartphone applications, or different ways to allow your end users to use your services and products. Art Hero is the central part, what we can see with the universal login. So, Art Hero as a cloud platform provides you a single son on experience across those different portals. This is very important to improve the user experience and with the latest browser limitations of the blocking of like cross-site cookies and so on, it's super important to have this externalized login page. The universal login, what we provide is an hosted login and it provides a lot of features and functionality that you can easily enable and adopt to provide this frictionless user experience for all your products. First of all, we provide different ways of authenticating the user. So, you probably know that a lot of websites offering the sign in with username and password and that is okay, but it adds a lot of friction. And by using the latest methods such as password less login, so we send an ODP to an email or an SMS to the end user, lowers already the friction. If you have some sensitive applications, you can also easily enable additional factors such as the authentication with face ID, touch ID, or some other biometric factors. When we think about the user login and the way users register themselves for applications, then it's a really bad user experience when you have a large list of fields where they have to provide like a username, first name, last name, email address, and so on. For that reason, Authero provides out of the box over 60 pre-built logins with social identity provider. Social identity providers is to sign in with Google, sign in with Apple, Facebook, LinkedIn, and so on. The advantage of using them is that the sign in is frictionless, you don't have to provide any password. On top of that, you also get additional information about the user because those external social identity providers, they already have basic information about the user. As I said, first name, last name, you could also get like the date they are birth and so on and so forth. When we think about enterprise applications, then those users typically live in their identity provider of those enterprises. And we make it very, very easy to connect to your existing enterprise identity provider, such as Octa, HID, Ping, and so on. Within this identity platform of Authero, there's tons of data generated. For that reason, we have a lot of built in functionalities to stream those log files to external services from AWS. But there is also a way to easily migrate your existing users if they are stored in some external databases or some other identity solutions. What we want to take a closer look in the next slide is how the Authero authentication pipeline works. And this is the big differentiator from the Authero platform to all the other identity platforms that you can find on the market. On the right-hand side, on the left-hand side, you can see that you have the application that you want to integrate with our platform. And on the right-hand side is where the user is authenticated and gets his ID and access token. How you can use those tokens, we will tell you in the next section of this webinar. But first, let's take a closer look on the authentication pipeline. So you can see that in the blue color, there is different extension points. Those extension points we call Authero Actions. Authero Actions are pieces of code which you can write to customize the user journey. Those pieces of code, the Authero Actions are written in JavaScript. You can think of them like an Amazon Lambda and they allow you to completely customize the way the user authenticates himself, but also the way how you enrich the information of the user. Imagine you have an application which is protecting some access to insurances and by enriching the token with information about, let's say, the insurances and user has, it's much, much easier to then consume the ID and the access token that you get at the end of the flow. The way the Authero works is that we have a lot built as part of the pipeline, but it's also powerful enough to redirect to some external websites before you are completely authenticated. Why do you need that? Well, if you want to request something such as terms of services or you want to enrich the user profile by prompting for additional information, then we provide a flexibility to add that as part of the sign-in process. So you can completely delegate all the identity-related topics to Authero. In the orange color, we can also see that there is a marketplace. The marketplace provides pre-built integrations which you can literally take, track and drop into our authentication pipeline. To provide you a good example is, imagine you have an online shop and you want to sell alcohol. You're only allowed to sell alcohol when the user is over 18. So you need an identity-proving and by using our marketplace and pre-built integrations for identity-proving, you can easily add that into our authentication pipeline and you don't have to touch your existing application because you can completely delegate it and make sure that the user is authenticated at the age of 18 or older before we actually allow the access to your application. On the next slide, we can see an overview about the Authero ecosystem and all the integrations that we have. As I said, tons of pre-built integrations with social identity provider. Why is it important to have those pre-built integrations? Well, it allows you to try out those integrations faster and it also increases the time of delivering more features in a short period of time because you don't have to come up by yourself in creating all those integrations. For a lot of the features, it's basically a switch of a button to enable and try them out. On the next slide, we can see that there are even more complicated use cases when we think about SAS identities. SAS identities is when you build your own SAS service like Confluence and Chira and you want to provide for each of your SAS customers which have their own tenant and sign-in user experience that is frictionless. And in this picture, we can see different ways on how the sign-in flow of such a SAS service can look like. On the right-hand side, we can see that you have an sign-in mask where the end user knows already the tenant name, but you can also start the sign-in journey by just providing the email address of the end user. And then in the middle section, Authero can customize per SAS or per tenant how the sign-in experience looks like with a custom logo, color, and the way the user authenticate. So in the first one, you can see they can sign in with a username which is managed completely on your Authero platform, but that organization also allows the sign-in with GitHub whereas the other ones only allow the sign-in with, let's say, HID and so on and so forth. The screens that you can see here are hosted by the Authero platform. That means you can completely delegate that logic and heavy lifting. And large customers that's actually using Authero for that purpose is children confluence. So every time you sign in to an Atlassian service, Authero is running in the background to make sure that we provide this frictionless user experience. On the next slide, we can see that most people think about a platform like Authero that it's just a look inbox. And when you build your own application and if you use any of those services, yes, what you see as an end user, it's a simple login box. And in reality, there's even more components which you need. So what you typically have is sign-in with username and password and some basic capabilities to have a process to reset your own password. But in the next step, you want to reach a bigger audience. So that means you introduce the sign-in with social logins and for that purpose, you also have an increase of the users. But it means you also have to figure out a better way on how to support all those users. And with Authero, you have one central store with all the user identities. And we have pre-built components that allow your help desk to easily manage those users. With the new way of attracting more users, you get more traction on the platform. That means you have more fake accounts, you have bot attacks. And for that reason, you have to introduce some new mechanisms to fight them. So you have to verify the email. You need an email server that is scaling. You need some bot protection capabilities. You potentially add a capture if there are some more risks detected. And then in the next step, you want to improve the user journey to reach even more people. So you want to take the information that you get from the users and provide them to downstream systems, such as your marketing system, CIM systems. So organizations want to have this 360 degree view about their customers. And then last but not least, you want to expand the integration of a central identity platform into all your applications. That means it's not just a web application or a smartphone application that you start with, but you want to have one central login experience across the whole application stack that you have made be built or some organizations which you acquire to widen your offering. And for that reason, you get even more challenges. And you can see that with the full picture, custom identity is not just a look inbox. There's so many different components which you need and you can build part of that, but it takes months, even for organizations, years to build all those components. You have to maintain the components. You need some senior developers, some very experienced people who can deal with this complexity of security. You need PANTAS teams to make sure that what you have developed is also built in a secure way. So tons of challenges. And what we see is that organizations use a platform like Authero to delegate all the complexity into an ready to use solution so they can focus on their core products and they don't have to deal with that. And with that, I want to hand it over to Pratipa to tell you more on how you can authorize APIs. Thanks, Tim. Thank you so much. That was a very informative session. So whenever you hear of Authero, just remember the last slide, how many things that are ongoing and then what are the things that are behind the screens of Authero does, the components that helps to protect our data applications. So let's get started. Thanks everyone for joining. So the meat of the webinar is like securing the Amazon API gateway using Authero. So before we get started, I just want to put a pretext like, does everybody know what does an API means? Like what does it mean? API is nothing but it's an application programming interface It's a set of protocols that enable communication between different software components. So these software components doesn't have to be of the same system. For example, like you have an API gateway, but the components that are talking to the API does not necessarily be the same from the same application. So API just stands in the middle of the API. It just stands in the middle of the actual data and the client requested response. I'm sure most of you are familiar with Gmail. So I just took the basic Gmail API. So we have to understand like in, if you're talking about a RIS API, there are some basic components like respect to any API, it's a Google or Twitter, whatever, you'll have some base URL and then you have a resource. And then there is a method, whether it's a get or post. So in this case, let's say you wanted to get the profile, use a profile, the base URL is gmail.googlipace.com and then you have a resource URL to get the particular information. So Gmail V1 users is called a resource path and then it defines what method you have to use to get that particular information. So in here it's like a HTTP get request. Suppose you wanted to update some information like watch or stop, then you just have to make a post call. So this is basically an API. So what is Amazon API Gateway? Amazon API Gateway provides a solution like to create RIS APIs. You can also create other APIs as well, but just for the sake of simplicity, since we are going to secure the RIS API. So Amazon API Gateway provides a solution to procreate, publish, maintain, and secure APIs at any scale. As you look at the system, the architecture, I took it from the AWS. So this gives you a complete overview of how the API Gateway looks like. You have your web and mobile applications, IoT devices, and any other on-premises applications. As I mentioned, like these applications not necessarily have to be from the same system. So these are all distributed and they are all talking to the API Gateway. The API Gateway has Amazon CloudWatch so that you can monitor how the requests are going and stuff. So it sits between the data just like your Lambda, Kinesis, or EC2. And the applications that client can access all this data through this interface. So what is the highlight is like, if you mean that you have data and you're accessing the API Gateway, it means that it has to be secure. So API Gateway provides these are all the authorization options you can provide. So the IAM resource policies and cognitive and customer authorization, these are all the authorization options that are supported by API Gateway. The choice of using the authorization options depends on your use case. So ideally if you are living in a system outside of AWS or like if you have multiple software components interacting with each other, the customer authorization with the AWS Lambda function makes sense. All the others are actually tied to AWS system like IAM and resource policies. So today we'll just see how we can use Auth0 as an authorization server to secure the API. So what are we going to build today is like, first I'll create a Lambda. So that's the resource that we're going to protect via securing the API. So I'll connect the Lambda to the API Gateway. We'll create two Lambda so that we'll know like how the secure versus the unsecured API Gateway looks like. And then we'll create an authorizer Lambda and then we protect one of the resource path like we saw in the Gmail like, let's say we say create user and then say get user. Then we can protect one of the resource using the Auth0 authorizer Lambda. Though it's like so much explaining of the things it's actually the implementation part is very easy. So what I'm going to do is like directly go into the AWS console and then quickly build stuff. I will just open the AWS API Gateway. If you're not seeing the screen just let me know. So what I'll do is like the sake of use easy so what I'm going to do is like I'm going to use the existing Lambda function that are available. So what I'll do is like create a Lambda use a blueprint say get users Auth0 webinar it has some data so I'm just going to pick some whatever I have we need to create the function to update the code. Just starting the like quite great the function will take some time because it has to create the roles and then the city permissions team work the Lambda function once it is done should be easy. So I'm going to update the code. So what it basically means is like if you invoke this Lambda function you will just get a message going to deploy it. Okay, so I've created the first Lambda function. I'm going to test it. So what I'll do is like okay so it's working. So we'll go back and then I'll create another function with the blueprint say create user the Lambda is basically is your actual data so you can actually connect to the database can fetch your cloud watch logs and stuff I just wanted to keep it simple so that's why I didn't add much feel free to connect to your data and then you know fetch it. So I'm going to deploy this change quickly test it but two ways to test it I think this is easy okay so yeah we got the results anyway so both Lambda functions are okay so what I'm going to do now is like create the API gateway as simple as that just create an API as I mentioned like Amazon API gateway provides the provision to create HTTP API WebSocket, REST and this is a private API so we are just focusing on REST and I'm just taking the public API so I'll say build let's say all zero webinar REST I'm just going to leave everything as such okay here comes the part so like I mentioned the API gateway has resources and we have to define the method so what I'm going to do is like I have to define two resources say create user and then like create and then maybe list and then I'm going to connect it to the Lambda so first I have to create a resource and then call it getUser and this is my resource path so I'm just keep it simple so say get creating this resource currently it is not connected to any of the stuff now I'm going to hook it to the the Lambda so what I'm going to do is like in the get resource I'm going to create a method I'm going to call get and now it asks me like what kind of integration I wanted to set up for the API gateway so I'm going to use the Lambda function and maybe integration and now I have to find the Lambda function so getUser's Webinar is the one we created then I click on save it just asking me that I'm going to give permission because we are connecting it together it's asking me like do you want to give the permission for API gateway say okay so we have done the connection between the getRequest and the Lambda so you have one path this is called authorization like do you have any authorization set up currently we haven't set up anything so it shows none and then I set proxy for the Lambda this is optional like if you want to transform the request what goes to Lambda and what comes out of it you can just set up the integration request I prefer to have the formator data going between the Lambda so I used the Lambda proxy so now it's connected there's a quick way to test it so what it's done is like you're accessing the API so just say test it so you're actually calling the getUser a Lambda so it works going to quickly create another source so let's say and then now I have to add the method so what I'm going to do is create the method this is when I went to say post okay now again I have to set up the Lambda function which Lambda function I want to integrate also create this now let's say create user same same step done test it quickly it's not accepting any post method so you can just click test so now it says like user created successfully which means that the integration part is done it is working for the API gateway this is just one first step we have to actually deploy these APIs to make it available as an API HTTP API so what I'm going to do is like I've created the resource I'm going to deploy the API so we had to mention which stage you want to deploy call front okay so only when you deploy these changes it will be available so for example I don't have any resource until this so let's say I get so you can see the response I get if you want to have look at the value of put which is already deployed I'm just going to make a quick call so now the integration works perfectly the last step which is like we have done the integration now everybody can use the API gateway like Tim mentioned anybody can do a bot attack or anybody can access this API because it's public so it's better to secure the API so what we're going to do is like start securing this API we have an option called authorizer so in here I had to create an authorizer as I already mentioned authorizer is another lambda you have to mention like how the token that you receive or the authorization value that the authorization and the access token how this is going to be processed and how it's going to get evaluated so I'm going to quickly show you the code because I thought it would take sometimes I've already deployed the lambda which does the authorization part so this is going to be your authorization lambda so this will receive the token and then verifies that the token is valid or not basically it actually uses the JWKS endpoint to verify whether the key is valid or not this code is available in our OZero GitHub but I can also share it so it will actually basically check like if the document is valid like if the key is valid let's say for example you have an access token from OZero or any antiprovider and you pass through this authorizer it will actually check with the authorization server whether that particular token is issued by that authorization server so you have a series of validation like it checks for the signature of that particular token it gets the public key from the authorization server so all these things are done here just verifies whether the token is done or not once it is done like let's say if the key is valid you're going to get a valid IM policy return if not then it will say like there is an error the token is not a valid token there is one thing that we have to do is like there are couple of environment variables I'm going to show you quickly the lambda this is my authorization lambda I created a generic lambda so that I can change to any OZero application so it takes three environment variables one is like which API you're going to protect that's called an audience and then there is a JWK's URL and then this is a token issuer I'll show you how I graph this data from the OZero application dashboard so login to your OZero tenant basically you will see this page on the homepage so go to your applications so whenever you wanted to secure the API the first step is to create an API so just create an API and then say OZero webinar API and then get the endpoint so I'm going to use this it can be any URL so I'm just going to use generic so that any resource under this audience can be otherwise it will strictly match so I'm going to use this then you create an API once you create this API you get some client ID and identifier and then how long this token is valid by the just created by this application and stuff so I'm just going to leave this at the moment because we have to come back and get the value so the identifier as I mentioned is the audience so what I'm going to do is like I'm going to quickly directly change it the value I have to make sure that I use the right identifier so I'll grab it from the dashboard and then I update that it's done and the JWK's URL and the token issuer are mostly the common if it's the same tenant so I'm using the tenant for the jwk.com and the JWK is json is normally the same like your tenant name underscore well known or json so this json will have your public key and stuff so you can go to JWK.io and then sorry json lint and then see what all the values it has and then the token issuer so I'm using the my tenant so I'm using the token issuer token issuer so once this is all done I'm going to say now this 0 or the lambda will respect only the access token coming from this API because I've changed it so what I'm going to do is like create this authorizer now since it's already deployed it should work so I'm just going to quickly test it I have this token grabbed from something else like it's not from the current application so if I'm going to test this lambda it will fail so it says like it's not a valid token if you look at the logs it says like it received this token and then say there was an error saying that this token is not a valid let's say I'm going to use the proper token associated with the API which I created so if you go to the test tab and find some accessible access token I'm going to grab this token and just want to test whether my authorization lambda works so this is my even json so this is my authorization token I'm going to save it just make sure the json is in the correct format okay now I'm going to test it so if you see this lambda for that particular audience so when I grab the token it says success if you see the response this authorization lambda is giving me a principal ID and then it says like I have the authorization to invoke any API but you have to restrict it but I have just mentioned like I can invoke any API so my authorization box what I have to do is the last part is like go to your API gateway and connect your the authorization lambda which is meant for your API gateway so I have to create this authorization and say let's say Auth0 webinar authorizer and then it should show me the list of a lambda I'm going to choose my authorization lambda so we are going to use token based authorization so I'm going to say token and then the token source will be the value the header will come as authorization it can be anything you just have to mention it in your code if you want to do the validation of the token before even validating you can add it like if you want the token to have better with some number with symbols then you can validate it otherwise before even invoking it will just validate whether the token is coming with the proper specification I'm just going to create it and say grant and created so now our lambda is working I just want to test whether the authorization part is working so let me say test what I have to do is like add the token and see whether my token is working so I'm going to grab it and bring now we are testing it independently we have not tied the authorizer with any APK I'm just making sure everything is working so I'm getting the response which means that let me check yeah I'm getting the policy code for example let's say I mentioned something and then say test that will fail so okay we are good the last and final step is to connect with this authorizer with the particular stage so if you see here I'm going to quickly refresh it sometimes the authorizer will not show it in the drop down so we have two methods post and get so I'm going to just update the authorization of the get to the authorizer so click on edit so it will show it will show only in the drop down only when you add it so otherwise it will not show so now what I'm going to do is like I'm enabling the token based authorization for only the post okay it's done so it's enabled let's come to get there's none I'm just going to leave it just to show the difference between this two so now what happens is like our APA gateway is set here with the authorizer and it is connected to our Auth0 and server so what happens is like when you don't have a proper access token issued by the Auth0 then you cannot access this APA I'm going to quickly show you in the terminal so as we know let me grab the wrapper so I have to if you remember I have to pass it as authorization header and then I mean you have to pass it in the header as authorization so I'm going to grab the AP token once again see is it funny to call it now this is not my address I'm missing something I'll tell you what it will not work I'm not sure if you can guess why I have to deploy the API I've added the authorizer but I've never deployed it so currently it's not secure so if you just curl without the it will work so let's say curl and then miss this it will work see it's working what because I have I made all the changes I never deployed those changes we actually tested it only on stage by stage so only now like once so that's a part so only now you have to the API which you attached to the authorizer is available so now if you just do a curl it will not work I don't know why it will take some time to take some time to refresh so ideally what you have to do is like pass this in the authorization header and then you do a create then it will work otherwise it will fail as the other one which we have not attached to the I'm going to deploy again I'm not sure whether deployed all the resources there is a problem sometimes it will deploy on me there's the simplicity now what happens is like get I'm in the wrong one this is my webinar if I use the correct I haven't deployed the correct one I just do one more deployment because I was in the wrong path yeah just now it's reflecting because I was deploying the wrong one so it means like I'm just making a direct curl without the header it doesn't work it says unauthorized now I'm going to update call the same with the header with the token now it says great and our gate is always works because I think because we never secure so let's say it always works but you don't need the header that's all we have for the demo and I have few things to share on what's happening under the hood so what we saw was very simple things but there are a lot of things that are going underneath behind the scenes so this is what we built today one is like your client using the browser terminal but it could be from your mobile application or any IoT devices we had an access token from our OZERO anti-server which provides an access token and we grabbed the token and then we sent the token along with the request and the dotted line is what we have built so we have an APA gateway that was connected to the API and we have a JWT authorizer that is also connected to the APA gateway and before even it connects to the Lambda or your data resource it checks whether the token that has been sent by the client is valid or not so this is the overall picture let's see what happens in step by step so what the first one is like we have a request we have the token that is sent to the user the second is like this token is sent to the authorizer so the Lambda which we have written has the verification of the JWT part it has to talk to your OZERO authorization server that's why we have to give the TANNN names and the JWT signature URL so once the token is verified so it talks to the server so once the token is verified the APA gateway will talk to the Lambda if there is any problem with this other token being like the signature is not correct or this token is not valid then what happens is like it will deny and then it never makes a request to the Lambda so assuming that this token is legit so the APA gateway makes a request to the Lambda and that's why we get the responses like the user created successfully response this response is sent to the client the APA gateway has the function to format the response based on the client and that's all about that and I'm going to ask Peter if you have any questions from the audience and thank you so much thank you Pradeepan thank you Tim for both of you excellent presentations and we do in fact have a few questions from the audience so if you can well if you can help out that will be great so the first question comes from Matthew and his question is do we have any examples or documentation on implementing token exchange using an APA gateway and that went to either Tim or Pradeepan I can take that question we do have a documentation on securing APA gateway using odd zero I can if you want you can just drop a note or I will drop the resources in the chat if you could do that Pradeepan I think that would be great we have any links to that I hope that answers your question Matthew and Pradeepan we'll follow up on that next question is from Thomas we're using a similar setup and our front end requests a few rest resources upon loading on multiple landers and I've seen some network latency when loading the JWKS.json obviously as it's an HTTP request to remote data center is there a best or at least a good practice to verify token signatures in a serverless environment without loading JWKS.json from network on every load for example caching in ephemeral storage and also how should that cache be refreshed I can take this question as well since it's a network latency and stuff what you can do is the primary reason of contacting between the JWKS is to verify the signature so you can actually download the signature and you can cache it in your local storage and Lambda has an ephemeral storage as you mentioned so I can use it in .pem5 in your since it's a public key you can store it and you can get that data and then do the verification there might be SDKs that support like which I have shown is like directly call the JWKS.json and then resolve it and verify the signature you just have to look for SDK that supports looking for the the public key in your cache system I'm sure that should be done it should not take much time yeah yeah and in general I mean there's two different ways on how you can validate the access token one of them is to send the access token to the introspect endpoint I guess that is the project you currently use where you send the access token each time to the introspect the other one as mentioned is that you can also cache the key within your application and then you don't have to do those external calls every time so as long as the access token is weighted and part of that access token is a claim that tells you how long it's weighted I think typically like an hour or so that means you don't have to validate a token within that hour to make sure it's still weighted cool, excellent thank you for that question, next question is can I use C++ or is it only Java that supports it this is for which language support do you mean the custom authorizer sorry I'm not sure I've just got a I don't know if you can have any update on that question or can add some additional context to that certainly all zero I can answer from the authorization server perspective all zero is an authorization server and it follows industry standard for OpenID Connect and OAuth 2 and there are a number of endpoints that we provide as APIs so you can actually call the all zero authorization server from any language it doesn't have to be Java or JavaScript or any particular language is open to anyone and since it's a Lambda function to build the authorizer so AWS Lambda supports most of the languages even from PHP, Java C, Swift and stuff so don't think there is any limitation with the language here yeah and if the target application is written within C++ so that's typically the case when you have a desktop application then there is different as the case like the QT framework which allows you to host a website within your own application and by adding a theory to that application you basically show a browser and that browser window the full flow of authenticating the user and so on happens and then when the user is successfully authenticated you redirect basically back to your C++ application to get the access token and that's at least what I saw when a customer was having a Java application cool, thank you Tim okay we've got a couple of more minutes left and a couple more questions so that works quite well Federico's question is how does the authorizer check the token does it call slash introspect what do you call it Tim yeah it calls the introspect since we answered the last question so it calls the JWKS endpoint so that's how the authorizer verifies the token cool one last question from David, I have a question about the JWT authorizer is the code on GitHub the code of the authorizer is it it's a lambda isn't it the authorizer I presume yeah so what I have the code which I have written is in serverless framework I just showed it from the console so that you know what resources you are using so it's in the GitHub, it's in my GitHub so you can visit Hradipa P and I will share the GitHub links yeah my repository cool, excellent thank you if you could go to the next slide please Hradipa and we'll wrap up the webinar we've got some upcoming events I'm going to post some links now into the chat window and these are some upcoming events we've got on zero integration and kind of our hands on lab that we do and if you could go to the next slide as well please Hradipa then you can also I've dropped a link as well into the chat window previously and you can sign up to our zero index newsletter which will give you additional development based hints tips and tricks all around security so it just leaves me really to say thank you everybody for joining today thank you Hradipa thank you Tim for two excellent presentations and of course thank you to everybody who's joined and may this webinar possible so thank you all take care have a good rest of your day bye bye thanks for joining bye bye have a nice day


Hello everyone. In most cases the need for flexibility does not account for the people working with the system. Handling things like customer journeys, personalization, creating campaign pages, analytics and you know all kinds of systems like that. Typically when a client says flexible it usually means something else than when we say it. And more flexible means more complexity and also harder to use. So how many of you haven't heard things like well we want to change the CMS because what we have today is hard to work with or Drupal is complex which brings us freedom and that's fine but it can be overwhelming sometimes or Drupal has a steep learning curve but you know when we get there we want to make our clients the superheroes and we're sort of just helping them to get there without spending hours and hours of learning and reading and documentation and hard workflows which involve basically too many people often. Are we in front come? We believe that we can change that. We strongly believe that we can turn Drupal into the most user friendly tool out there and we've just started. We want to make all people that are working with content and creating value from day to day to be the superheroes. We want them to be able to focus on what they are supposed to do and we want it to be fun to work with Drupal. Now when we were in Drupal Europe last year we showed what we had done so far with the Drupal Gutenberg module and we got some awesome feedback which encouraged us. Our most important client in digital projects are those who are going to work with the system day in and day out and this is not really about technology or coding or features it's about having the tool to make the job easy fun and enable the user to focus on what really matters and this is what we experience when introducing the Gutenberg editor. Some people that have to work with CMSs for years can seem skeptic at first you know the change is too big. I don't know where to start. People won't understand this but that is just opinions. What we see with people that are new to CMSs are reactions like this. Things evolve. This is excellent. You know we want this. Where do I sign? Stuff like that. Drupal should be the most user friendly enterprise CMS. And this is also what this was talking about in the recent note today. Drupal should be easy to use for newcomers and we think it's possible. This Drupal community are full of superheroes that can make this happen. Now let's go a few hundred years back in time and have a look at this guy. Johan Gutenberg. We're still using his name. He played a key role in the development of the Renaissance, the Reformation, the Age of the Enlightenment and the Scientific Revolution. That laid the basis for spreading learning to the masses back then. And today we are working with software to the masses. And open source is truly that. We're not talking about virtual reality though in this session. But Gutenberg is kind of you know in a sense a part of a new way of thinking web content generation. And we can say that Gutenberg gives our eyes new input on the aspect of creating content for the web. It is a revolution that changes how authors and editors can focus on their daily deliveries, not just you know brag about being the ones that understand how to use a system. So what is actually the Gutenberg editor? Well this is a tiny bit of it. Let's dig in. So this is in Norwegian but I go to a new page and I start to add for example a heading. I type in some text there which should be my title. I set that to be the H1. And then I'll paste some more text. And this should be my teaser, bold slightly larger. And of course we want that to be like the separate proper Drupal field. We'll get back to that. I paste some more content and I want to add an image next to that content. So I just drag and drop that into the editor and it loads and I'm able to align it in the way I want. I can remove my spacing up there but then I want to maybe drag it to make it smaller. So very very flexible but some of you are my thinking you know we can do this you know we need to follow our grids in our design and totally we'll get back to that. So now I'm just adding some text here a caption for that image. And I can also show you something here which to add new blocks I could just start by typing a forward slash like you see here and then I will start to type gallery. You see a live search and now since this is the top of my results I can hit enter and it adds that block. I go to the middle library and select a few images that I think is nice. Hit select now. Thank you. And then I'm able to move my images back and forth the order. I can also choose to have like four column set up which looks like this or I could change it back to maybe two or even one which kind of doesn't work in this context but might do in others. Then we could try to add something like a quote in the bottom here. I start typing my opinion and I do that in a regular paragraph. It's just like it's just like some text. Then I can convert that to a quote and you see that I get a new field below there. I'm able to set the author for that quote which is myself in this situation and finalize it like that. I'm able to drag and drop it up to where I want. I can also use the arrows for that and you see that the focus of that block follows the rest of the page so it's not that confusing to see where you are currently. Okay so we'll try to go slightly deeper into it. Look at another kind of layout that we could build just with the core Gutenberg blocks. In the bottom here I'm adding a column and you see that I get a layout to choose from there and I want to choose that one which has a slightly larger left column and a smaller right column. This could all be predefined of course following my design for the site. I'm just going to copy paste some text up here and paste that and then hit the plus button for the right column to be able to add some content there as well. Let's start with a quote which we tested earlier. I think we should use Marco for this example. What do you say Marco? Nice column. Will you use that Marco? Yeah yeah he says that he will. For sure. Marco. Great. So right below that I can hit the plus button to add something above that quote and I want to add an image. Let's find an image of Marco which is not Marco. You know he's still there out here in the darkness but he's coming out soon yeah. He doesn't look like that though. And then we can add some contact information for Marco here below. A telephone number. This is not really his number though so you can't really troll him by trying to call him during the session and some email address. Now this is just a text paragraph and I can set the background color to that and notice that it also inverts the text color but I am able to override that if I really need to by going down to the text color option in the bottom there. I want to keep it white and then I'll just copy paste some more text just to fill out a bit. A couple more quotes and there we have some kind of layout and you see that I'm actually able to resize the columns. Then again too much flexibility for 95 percent of the cases you know but we are able to do something about that as well. So this is my page built by Gutenberg core blocks only. So who's using this? It's quite new for our sake and in general but still out there on the internet there are millions of sites using Gutenberg already and that's some of the benefits and the strengths for it. However in this session we will have a look at UNICEF Norway which is our client. It's been on Drupal for several years and their production site is actually on Drupal 7 currently but we're working on that. We'll not talk about their strategies or their numbers in this session but their user experience. They have a communication department of somewhere between five and 20 people that will work on their website content on a regular basis and they are competent people which needs flexibility to build the landing pages that they need and tell their story through rich content. Now what they don't want to do in that department is graphical design. That they have other people to do. So that was the teaser. We'll soon get into the details. My name is Thor. I work in Frontcom as a consultant and team leader. I'm also the leader of the Drupal Norway Association and with me I have my friend and colleague Marco. Yeah hello I'm Marco. I'm a senior developer and architect in Frontcom and the lead developer and maintainer for the Drupal Gutenberg module. So Frontcom in general we are an open source company meaning that we also do frameworks like Larval and Symphony. Also WordPress sites Node.js and even mobile applications in addition to of course Drupal. We are an innovation oriented company which among other things has resulted in the work that we did porting the Gutenberg editor from the WordPress community and to a more CMS agnostic solution. We are about 55 people spread across these countries Norway, Portugal where Marco is from, Poland and Germany. Okay back to UNICEF. Let's take a look in the setup that they currently have. What we see here typically in the top is some kind of hero block. It has a background image. It has a title and a small teaser text and a link at the bottom. So let's show an example how we could use that for other kind of contents. So here we go. So here we have another background image. I can choose to use a new one. You see that there are some people there in Frontcom, Frederik's the office and I can go straight in and edit the title for that. I could do the same of course with the button. I just go in and select my text and overwrite it as I would like. Below that I have that link URL field. So I can if I choose here to go for straight for the demo site I can do that. That's actually the site you could test by the way if you want to do a demo. And then we have some options here in the sidebar where I can turn fields on and off. To be able to do proper comparisons and examples we are kind of focusing on the hero banner block today. This is another example of that with some slightly different options. Notice for example the focal point image down there in the corner where I could easily select some part of that image and that would live update the background image for the actual block. A couple of other projects. Here is a similar kind of hero image done for the Norwegian Children's Cancer Association which was launched recently. And another example here with more flexibility which basically require more from the content editors. But it's both built on Gutenberg in production. And actually each of these two sites won two different splash award prizes in the Norwegian splash awards earlier this year. So let's get into the best practices of how we work with Gutenberg. Now this is a couple of lists of the Gutenberg core blocks. And as we speak people are working on hooks to enable to extend them. And the functionality can already be kind of replaced with JavaScript on the theme or in a custom module. So what we see here to the left are all the regular kind of blocks that you could add to your content out of the box. We usually turn a few of this off just because we don't need them and just reduce complexity. And to the right here we have a long, long list of embed solutions that just works out of the box. So for example here you can see that I've turned on YouTube, Twitter, Facebook and Vimeo which basically means that I in my page built on Gutenberg can just paste a URL to that and it will load that tweet in a nice way or the videos you can play that straight into the editor for example. Okay. The point of this slide is simply to say that you know if people can do something you know someone will. So even if someone here thought that it was both fresh and awesome I am not sure if I disagree and the designer probably won't either. So let's talk a bit about that. Let's say that you want to build some kind of grid like this what we're seeing here. I will just start that video. This is how it's supposed to be looking. And what we usually do then is to try to use some core blocks first and experiment a bit with that. So I'll just try to build it. I start by a columns block. I need three columns here. And then I can go into each and every one of them and just paste some content. And I will basically just do that for the three columns here. So what we're looking at exactly is a group block in the background which I can set that background color to. And then there's an icon in the top which in this case is just an image and there is a paragraph and there is a button. So yeah we've sort of come quite a long way with this but you can also see that it's very very easily breakable. It doesn't look like the kind of interface we want and it's really not the kind of flexibility that we actually need. So let's look at how we solve that after having some dialogue back and forth. Well you need an icon selector in the top there. You can see there's icons in all of the three columns and instead of having like a live search or a huge list of icons we could simply take their library of icons which is probably 200 and create some UI like this. You click it and it live updates immediately. They have categories for that so you can see that there is a lot of icons to choose from basically. The same thing goes with for example here the background colors. If I scroll a bit down I can see like a very basic preview on how that looks and when I click it you see that it immediately updates the actual content that I'm working on. Of course I can do things here like going in and change texts as we can with any other block. Notice here though that most of the fields down here they don't have any formatting options. It's supposed to be strict and the people in this company they agree with that. They want them to follow the design principles and the design guide that is made for the site. Now here's a kind of other example. Just going to start that and then pause it. Here you see like a traditional regular slider. It slides automatically and if we consider that yeah we want a vis-a-vis that is you know very close to real-life situation. We quickly get into a situation where it's not ideal to work on a moving slideshow and also if we have like more than five six seven slides to this kind of slideshow it's going to be very difficult to navigate in that. So when we load this we typically get something like this instead. You can see a preview of the four different slides that we have in this case and then you can sort of open one of them. It pops up. I can go in and do my edits and then sort of just close it down again when I'm ready. So that's different from the vis-a-vis approach but it has good intentions. So should we go into the tech details? Let's look at how to build a custom block. So Drupal Gutenberg comes with an example module containing an example block just to show you how to get started. Let me click here. So going through my site folders I find the example module block module here at Gutenberg module folder modules and then I can just copy this example block folder to another folder into the Drupal site modules folder. And let's just rename it. Okay and since this is a module we also need to rename the configuration files. Another thing we need to do is go to the Gutenberg configuration file and also do some renaming. Okay. That will actually create a new Drupal module, right? That can be enabled and disabled. But that doesn't mean that we need a new Drupal module for each block. We can have kind of a library of blocks in one module. Sorry. Okay. So let's have a look at this block in the editor. Here's how it looks. First we just insert at the block and here we have a title, a subtitle, text and yeah, help text that's only visible when editing the block. Just a specific functionality implemented for this block. But now let's change this block a bit. Now the module works even with the package JSON name example. This is because the code we cloned from the example block is already compiled. Let's rename it. And yeah, I have a name for the package and run the npm install. What this will do is install all the JavaScript and the CSS build files or build tools. And what I want to do in this block is just take a bit, right? It's done, right? I want to, yeah, remove this image on the right side, also the help text and maybe just increase the title font a bit. To find the source of this block, we go to the index JS file, a GGS file folder. A block is made of these attributes. Also we have this edit function. It returns basically a component that will handle, a written component that will be handled on the editor. And at the bottom, you also can register a new category. Blocks also contains some styling here at the size folder. We typically had layout styling on the block itself. But global styling like fonts and colors and elements will be defined in the theme. Okay, so let's start editing the GGS file and change our block. So we are editing here on the settings. Awesome description. We can also set an icon for the block. Just a note here, Gutenberg library already comes bundled with a library set of icons. We can use those or you can use your own custom icon there. Okay, so that's done. Let's go to the bottom and edit the title font size. In this case, we'll just change it to H1 adding tag. And let's remove the right side column. And also we need to do this for the saved components. So this is where the HTML will be rendered. So we'll change the title and remove. All right. So I want also to create a new category that will be available on the blocks list. Let's call it awesome. Yeah, that's pretty much it. Just need to save the file, compile the GSCode or transpile, running the build script. Just takes a couple of seconds. And let's test the block. As you can see here, we have the new category awesome. And here's our block. That's just ready to use. Text there. And some more text. Sorry, the guy who made this video was a bit slow. Not sure what. Having a great time. All right. And we'll just save the notes. Pretty simple. Good stuff. So what about dynamic content? If you want within your page some view maybe or other things coming in, is it possible? Yes, totally. It works like a charm. All Drupal views are available in Gutenberg. Actually, all Drupal blocks. You just need to activate those views on the content type that you wanted to be available for Gutenberg. And actually, a way to set parameters to blocks is work in progress currently. Not fully done yet, but things are coming. So you can do that sort of straight in the block itself. Okay. So now we just want to cover a couple of frequently asked questions that we've gotten from you guys. So the first one is like, yeah, what kind of sites do you recommend this for? Well, we recommend it for large sites with lots of content and editors. The huge sites. The sites with so many people that, you know, it gets really expensive and hard to sort of train, maintain, keep everything up to date. But also for smaller sites, of course, it works. Does it provide too much flexibility? Well, we have seen a sample of that it does that. But the answer is no, because that's, you know, before it's actually set up. This is actually the place where you're able to properly do something about that. Show exactly the parameters you want. Design the back end so it works closely. Can it work with workflows? Sure. Can we use it with other modules? Or if we switch module later, do we have to rebuild things, stuff like that? It generally handles that very well. Even if you turn off the module and deactivate it, the content will still be there. As Marko mentioned, some styling may come from the block itself. But that's typically layout things. So you could just move that styling over to your theme instead and you're ready to go. Is it secure? Yes, it's just as secure as Drupal itself. And does it really scale the performance of this? It totally does. The data that we store here is easily cacheable. There are a few database requests. And if you use cloud blocks, you'll actually get Cloudflare CDN straight out of the box, which is basically serving data faster than most websites out there. So let's just have a quick look now at the work going into Gutenberg module since we started. This is basically a list of the releases that we've had for the Drupal Gutenberg module. So before the track record here, we started the actual Gutenberg JS work porting the library. And here you can see that we've had quite a lot of releases. The stable release 1.0 was in the end of May. So it's basically just four months ago since we had a stable release. And we already have more than 800 production sites out there using this. So the release cycle here is about roughly every two weeks when we have a new update. And there is actually one more release coming since I made this slide. But you know, where should I put that? So I just left it. Short-term roadmap. Yeah, I can see it's like a mirror of all your guys sitting here. Let's talk a bit about the new exciting things that we were planning ahead. Currently, we are working hard to have a full integration with media and the media library. And that fits well with what is being shipped with Drupal 8.8, as Rhys was mentioning this morning. We already have that available in the dev branch, if you want to play around with it. And another exciting thing that we're planning is to include page templates coupled with field mapping. Let's quickly go into what that is about. There's also a couple of other interesting things here. If you want to know more, reach out after the session. Yeah, just a quick word on the page templates and the field mapping. Let's say we have a simple article structure that has a title, a teaser text, a featured image, and a body field to freely add the content. With this new feature in the Gutenberg, it will be possible to have a template for a content type like this. So here, when creating a new article, the editor just needs to fill out those fields or those blocks without worrying about the layout. And then we could actually map those blocks to Drupal fields using the upcoming field mapping feature. So in the end, we just want to show you one last example of a typical hero block as we talked about earlier. This one specifically also has a background image and some text fields and a button. They needed a couple of variations for setting different background based on screens and also a way to move the title box there either to the left or center or right. Apart from that, it's the same. Apart from this little feature, when you click use video as background, it actually instantly fetches the video straight from Vimeo. And I'm still able to work on the content on top of that. And if I paste a new ID, it instantly fetches a new video Vimeo in this case. And you can just keep going after that. And this is, of course, very nice for these people that are actually working on building this content. They can focus on their wording and know how to place things without going so much back and forth between preview and the editor. And we basically see that usually you spend like 10 to 10% of the time that you usually do to build landing pages and content if you're thinking about just the process of creating, building the pages. Yes. So that's about it. We have, it's open for questions if you guys have any questions. And we'll also have a bird's web feather session right now after this session in the G110, which is basically a sort of free speaking questions, questions and answers session. So we can go into more details if you're interested. So are there any questions? And Marco, you need to stay closer because yeah. Yeah, I was wondering how the data is actually stored. So if editors like build these pages in such a way and they want to migrate the website in five years time, is it like one field with all the data in it or does it stored in subfields or whatever? Yeah, it's stored in one field, basically the body field, because it's basically just an editor. And so that makes it very easy to move that along later. And that's also why you can sort of turn off the module and the content will still be there and up running and working. But I can imagine like if you want to migrate, for example, the quotes to a new field in the new website, that it might be difficult if it's stored in one field? Well, that's the benefit for a module such as paragraphs, I would say, where all the fields have their own place in the database. You would, of course, need to map it to make it work. But like all the other kinds of stuff that you put in there, for example, views, like we mentioned, that would be like a dynamic reference anyway. And of course, the really interesting part is what Marco talked about, the fields mapping. And this is where you actually are able to put that kind of specific data straight into this. And it will actually save on a separate field. So we have that full structure for those cases. Hello. Yes. Do you support note translations? Totally. Yeah. Okay. Do you support revisions? Yeah, no problem. The Gutenberg blocks out of the box. Do you have any control over the HTML output? Like in paragraphs, you can alter the tweaks or you can alter the HTML. Can you alter the HTML of the Gutenberg blocks? Well, you kind of could replace easily one core block output by replacing the whole block. But currently, the Gutenberg community is working on some kind of a hooks system for blocks that, you know, you could easily just change the outputs of a block, even core blocks. Okay. That's it. Thank you. Thank you. Hi. Would it be possible to use it alongside Layup Builder? And would it make any sense at all? You can, of course, do that. We haven't done that yet. We've been experimenting a bit with it. But it's, of course, possible. But yeah. Yes. During the demo, you use only a body field. What happens if we use other fields to set some metadata that will be used in the different views and so on? Yeah. Sorry. We should have had that in our demo. Basically, the other fields that you need on your nodes, that could be a lot of stuff, of course. You have the option to either put them in the sidebar. So like on the, there were two tabs there, one for block specific settings and another tab in the sidebar for document settings. And that's where you could put, like, some fields for other fields that may require more space, typically. And those will be added below the standard Gutenberg editor. So you have, like, a more option further down the list. Any other questions? Okay. So thank you, guys. It's... As we mentioned, there will be a buff in G110 where we can discuss openly more. Welcome all.


Live from New York City, it's theCUBE. Covering CyberConnect 2017. Brought to you by Centrify and the Institute for Critical Infrastructure Technologies. Hey, welcome back, everyone. Live here in New York, just theCUBE's exclusive coverage of Centrify's CyberConnect 2017 presented by Centrify. It's an industry event that Centrify is underwriting that's really not a Centrify event. It's really where industry and government are coming together to talk about best practices, of architecture, how to solve the biggest crisis of our generation in the computer industry. And that is security. I'm John Furrier with my co-host, Dave Alontair, next guest, David McNeely, who's the vice president of product strategy with Centrify. Welcome to theCUBE. Great, thank you for having me. Thanks for coming on. I'm really impressed by Centrify's approach here. You're underwriting the event, but it's not a Centrify commercial. This is about the core issues of community coming together, the culture of tech. You run the product. That's some great props from the general on stage. You guys are foundational. What does that mean when he said that Centrify's could be a foundational element for solving this problem? Well, I think a lot of it has to do with, if you look at the problems that people are facing, it's the breaches are misusing computers in order to use your account. And if your account is authorized to go gain access to a particular resource, whether that be servers or databases, somehow the software and the systems that we put in place and even some of the policies need to be retrofitted in order to go back and make sure that it really is a human that's gaining access to things and not malware, running around the network with a compromised credential. So we've been spending a lot more time trying to help customers eliminate the use of passwords, try to move to stronger authentication. Most of the regulations now start talking about strong authentication, but then what does that really mean? Because it can't just be a one-time passcode delivered to your phone. They've figured out ways to break into that. Certificates have been hacked and data just came out.  But this is a new trend that we're seeing is that the independent credentials of a user is being authentically compromised with the Equifax, all these breaches were all personal information out there. This is a growth area for the hacks where people are actually getting compromised emails and sending them. So, how do you know it's not a fake account if you think it's your friend? Exactly. That's the growth area, right? And the biggest problem is trying to make sure that if you do allow somebody to use like my device here to gain access to my mail account, how do we make it stronger? How do we make sure that it really is David that's logged on to the account? If you think about it, my laptop, my iPad, my phone, all authenticates and access the same email account. And if that's only protected with a password, then how good is that? How hard is it to break passwords? You know, so we're starting the challenge a lot of base assumptions about different ways to do security because if you look at some of the tools that the hackers have, their tooling's getting better all the time. So, go ahead, sorry. Finish your talk.  So, it's kind of- You're hacked basically out there. When you talk about eliminating passwords, are you talking about doing things other than just passwords or are you mean eliminating passwords? I mean eliminating passwords. So, how does that work? So, the way that works is you have to have a stronger vetting process around who the person is. And this is actually going to be a challenge as people start looking at, okay, how do you vet a person? We ask them a whole bunch of questions. Mothers made a name, where you lived, other stuff. All this data that Equifax has. We ask you all that information to find out, is it really you? But really the best way to do it now is going to be to go back to government issued IDs because they have a vetting process or they're establishing an identity for you. You've got a driver's license, we all have social security numbers, maybe a passport. That kind of information is really the only way to start making sure it really is me. This is where you start and then the next place is assigning a stronger credential. So, there's a way to get a strong credential onto your mobile device. That the issuance process itself generates the first, the key pair inside the device in a protected place that can't be compromised because it's part of the hardware, part of the chip, the processor that runs the phone. And that starts acting as strong as, I would say a smart card. In the government they call it derived credentials. But it's kind of new technology. I mean, NIST has had described documentation on how to make that work for quite some time, but actually implementing it and delivering it as a solution that can be used for authentication to other things is what's kind of new here. A big theme of your talk tomorrow is on designing this in.  Exactly, right. So how do we, how do we solve that problem? It's just going to take time. Well, that's actually. New infrastructure modernization. So Dr. Ron Ross is going to be joining me tomorrow and he's from the NIST and we'll be talking with him about some of the security frameworks that they've created. So there's a cyber security framework. There's also other guidance that they've created, the NIST 800-160, that describe how to start building security in from the very start. So we actually have to back all the way up to the app developer and the operating system developers and get them to design security into the applications and also into the operating systems in such a way that you can trust the OS. Application that's sitting on top of an untrusted operating system is not that very good. So, you know, the applications have to be sitting on top of trusted operating systems. And then we'll probably get into a little bit of the newer technology. I'm starting to find a lot of our customers that move to cloud-based infrastructures, starting to move their applications into containers where there's a container around the application and it actually is not bound as heavily to the OS so that I could deploy as many of these app containers as I want and start scaling those out. So separate the workload from some of the infrastructure. You're kind of seeing that trend. Exactly. And that changes a whole lot of the way we look at security. So now your security boundary is not the machine or the computer, it's now the application container. So you run the product strategies. You like to have the keys to the kingdom of Centrify, but also we heard today that it's a moving train this business. It's not like you can lock into some of the eight calls with the silver bullet, it's hard to get the silver bullet in security. How do you balance the speed of the game of the product strategy? And how do you guys deal with bringing a customer solution to the market that has an architectural scalability to it, right? So, because that's the challenge. I'm a slow enterprise, but I want to implement a product. I don't want to be obsolete by the time I roll it out. I need to have a scalable solution that can give me the headroom and flexibility. So you're bringing a lot to the table. Explain what's going on in that dynamic. Yeah, there's a lot of, I mean, I try as much as possible to adhere to standards where they exist and push and promote those. Like, you know, on the authentication side of things. For the longest time, we used LDAP and Kerberos to authenticate computers to active directory. Now, almost all the web app developers are using SAML or OpenID Connect or OAuth2 as a mechanism for authenticating the applications. And just keeping up with standards like that is one of the best ways. That way, the technology and tools that we deliver just have APIs that the app developers can go back and use and take advantage of. So I wanted to follow up on that because I was going to ask you, isn't there a sort of an organizational friction in that you've got companies, if you've got to go back to the developers and the guys who are writing code around the OS, there's an incentive from up top to go for fast profits, right? Get to market as soon as you can. But if I understand what you just said, if you're able to use open source standards or things like OAuth, that maybe could accelerate your time to market. But help me square that circle. Is there an inherent conflict between the desire to get short-term profits versus designing in good security? Well, it does take a little bit of time to design and build, deliver products. But as we've moved to cloud-based infrastructure, we're able to more rapidly deploy and release features. So part of having a cloud service, we update that every month. So every 30 days, we've got a new version of that rolling out. It's got new capabilities in it. Part of adopting agile delivery models. But everything that we deliver also has an API. So when we go back and talk to the customers and the developer at the customer organizations, we have a rich set of APIs that the cloud service exposes. If they uncover a use case or a situation that requires something new or different that we don't have, then that's when I go back to the product managers, engineering teams, and talk about adding that new capability into the cloud service, which we can expect the monthly cadence helps me deliver that more rapidly to market. So as you look at the bell curve in the client base, how does it, what's the shape of those that are kind of on the cutting edge and doing them by definition? I shouldn't use the term cutting edge on the path to designing in as you would prescribe. What's it look like? Is it 2080, 199? That's going to be hard to put a number on. We do have a, you know, most of the customers are covering the basics, you know, with respect to consolidating identities, moving to stronger authentication. I'm finding one of the areas that the more mature companies have adopted is just in time notion where by default, nobody has any rights to gain access to either systems or applications and moving it to a workflow request access model. So that's the one that's a little bit newer that I would say fewer of my customers are using, but most everybody wants to adopt because if you think about some of the attacks that have taken place, if I can get a piece of email to you and you think it's me and then you open up the attachment, at that point you're now infected and the malware that's on your machine has the ability to use your account to start moving around and authenticating the things that you're authorized to get to. So if I could send that piece of email and accomplish that, I might target like a system administrators or database admins and go try to use their account because it's already authorized to go log on to the database servers, which is what I'm trying to get to. Now if we could flip it and say, well, yeah, there's a database admin, but if he doesn't have permissions to go log on to anything right now and he has to make a request, then the malware can't make the request and can't get the approval of the manager in order to go gain access to the database. Now again, I want to explore organizational friction. Does that slow down sort of the organization's ability to conduct business and will it be pushed back from the user base or can you make that transparent? It does slow things down. I mean, we're talking about a process. So it's a choice that organizations have to make. Do you care about the long-term, healthy your company, your brand, your revenues or do you want to go for the short-term problem? And that is one of the biggest challenges is just, we describe it in the software world as technical debt, some IT organizations may as well. It's just the way things happen and the processes by which people adhere to things. We find all too often that people will use a password vault for example and go check out the administrator password or their dash A account that's authorized to log on any Windows computer in the entire network as an admin. And if they check it out and they get to use it all day long, it's like, okay, where did you put it? Did you put it in clipboard? Malware knows how to get to your clipboard. Did you put it in a notepad document stored on your desktop? Guess what, malware knows how to get to that. So now we've got a system by which people checked out a password and malware can get to that password and use it for the whole day. Okay, so maybe at the end of the day the password vault can rotate the password so that it's not long lived, but see the process is what's wrong there where we allow the humans to continue to do things in a bad way just because it's easy.  We're here with David McNeely, he's the vice president of product strategy for Centrify. I got to get your take on Jim Ruth's seat of the chief security officer for Etno's on stage. Oh yes. Great presentation. Awesome.  He did do a shout out for Centrify. So congratulations on that, but he was getting at a whole new way to reimagine security and he brought up civilizations crumble when you lose trust. It's a huge issue. So how are you guys seeing that help you guys solve problems with your customers? I mean, is Etno a tell sign for which direction to go? Absolutely, I mean, if you think about the problem we just described earlier where the CIS admin now needs to make a workflow style request to gain access to a machine. The problem is that takes time and it involves humans and process change. It'd be a whole lot nicer and we've already been delivering solutions that do this machine learning based behavior based access controls, right? And we tied it into our multi-factor authentication system. But the whole idea was to try to get the computers to make a decision based on behavior. Is it really David at the keyboard trying to gain access to a target application or a server? And the machine can learn by patterns and looking at my historical access to go determine, does that look and smell and feel like David? So machine learning for example. And that's a huge part of it, right? Cause if we can get the computers to make these decisions automatically then we eliminate so much time that's being chewed up by humans and putting things into a queue and then waiting for somebody to investigate. What's the impact of machine learning on security in your opinion? Is it massive in the sense of, no it's going to be significant but what areas is it attacking? Speed of the solution, the amount of data it can go through, unique domain expertise to the applications. Where is the aha moment for the machine learning value proposition? Well it's really going to help us enormously on making more intelligent decisions. If you think about access control systems they all make a decision based on did you supply the correct user ID and password or credential? And do you have access to whatever that resource is? But we only looked at two things, the authentication and an access policy. And these behavior based systems they look at a lot of other things, right? He mentioned 60 different attributes that they're looking at. And all of these attributes we're looking at where's David's iPad? What's the location of my laptop which should be in the room upstairs? My phone is nearby. And making sure that somebody's not trying to use my account from California because there's no way I could get from here to California at a rapid pace. A final question for you while we we've got one couple seconds left here. What is the value proposition for Centrify if you had the bottom line than the product strategy in a nutshell? What? Kind of a tough one there. Identity, I mean stop the breach is the tagline but is it the identity, is it the tech, is it the... Identity and access control. At the end of the day we're trying to provide identity and access controls around how a user accesses an application, how we access servers, privileged accounts, how you would access your mobile device and your mobile device accesses applications. Basically if you think about what defines an organization, identity, the humans that work at an organization and your rights to go gain access to applications is what links everything together because as you start adopting cloud services as we've adopted mobile devices there's no perimeter anymore really for the company. And identity makes up the definition and the boundary of the organization. All right, Dave McNeely, Vice President of ProgStrike at Centrify. More live coverage here in New York City from theCUBE at CyberConnect 2017 inaugural event. Cube coverage continues after this short break.