There's a quantum product defined that this way. Roughly speaking, it cancels the number of genus zero stable maps to G1P passing through the two inputs and then the point guide deal of outputs. In current quantum sugar calculus studies this quantum product in terms of sugar bases. And today we are going to discuss this quantum graph module ring. And we will focus on three results, including quantum equals RFI. It doesn't variety presentation and the module mirror conjecture.  Ring of formal, I mean, ring of the ring of low on series. And always formal power series ring. And there's something similar to the G1P, like we have RFI sugar bases, which is defined to be the fundamental class of orbit closure or orbit closure. But here the B is the other end of a program. And T here is a torus fixed point of the other grass money and in general it is indexed by the code with letters. I mean, if G is simply connected. And we will assume in our talk. And but there's another set indexing this. The set of torus fixed one, namely the, the set of minimum length, who said representatives in the. W it is more convenient for us to, if we want to discuss the foreign results. And we have a fun general product on this homo, you can run homology range given by this. Very simple formula, but it is simple respect to this base that's the fixed point. I mean, well, let's also form a basis of the homology, but both after localized, the equivalent parameters are the simple respect to this basis. But it's not with respect to the alpha and super basis. So we could run our fine sugar carats studies for the onion product. In terms of alpha and super basis. So here's the first result. Discover by Peterson and proof by lamb and she was a little more. Namely, the alpha, so we have quantum equals alpha, but that's the ball the case when P equals borrow. In general, the alpha should work as determined the quantum in the following way. Namely, we have a explicit ring map. From our fine. At the homology of alpha grass on gas money and to the column called more G. Explicitly, because it sends a basis element. Of a super basis to the, to another basis of the quantum super basis. And for peace also explicit, but. Because it's a communicator so roughly speaking just send a basis element to another basis or zero. So we may go to zero. But what I mean by equals and determines means that in general this assignment of the basis elements are not bijective, even for people to be based not so if we in the following sense. Both, but this is injective. And it is a jacket if we multiplied by suitable quantum parameters. And here for general P is, it's also the same. If we take away all the basis element going to zero, then the assignment will be injected as well. And subject it in the same sense. And the public spoof by lemon she must always lies on some algebraic and computer identities. But I can. But for example, but quantum shape shape formula and Peter's and Woodward's comparison for me. These are formulas for the quantum. And there are some for the. I'm not knowledgeable enough to tell you more here. So the question is, can we prove the result. And more geometrically, but it is already, I mean, their proof is geometric because it depends on this formula, which is geometric, which are geometric. So let's look at something from sympathetic geometry. We can define a map and a pure another map with the same source and target. In the following way. First, let me introduce them. A more practical definition of that. Namely, the guy find out my cross money and represent the fungal, sending each scheme to the set of isomorphism classes of principle g bundles over P one cropped times gamma with civilizations over. I mean, away from the zero. And this result is proved by both view at last row. And by algebraically, and by precisely, analytically. So, this map costs surface side of map is defined in this way. So, so we call the domain is the homology. So it's represented by cycle going to Africa's money and so by the above result, it is represented by principle g bundle. Over P one times gamma with some civilization. So we can use this space to define comorbidant theory. Yes. Yeah, so this is the space. So we have a principle G bundle, and we can form the associate fiber bundle. So it's now a G more P vibration over P one times gamma. And we can consider the moderate space of stable map. Going to this space. With certain degree. The degree is not arbitrary, but the stable mess is required to contain a component. Which projects isomorphically downstairs to this section. But since we are, we are going to compare the five so we are allowed to some bubbles, but the bubbles will be projected to point downstairs so they are vertical. Vertical line inside some fibers, which are G more P. So these are the, so these are the requirement of the degree. So after and also we are sorry one more point. There's a one more point and it's required to hit the cycle over infinity. And because we have a civilization, we can spread it like this trivially using this civilization. And this output. So the, the one will be what we really mean. Is that the map is defined to be like this. Something like this. In the standard way how we, for some of this is, that's the way how we define for some of the common cop product. Yeah. And there's some issue about how to record a degree using some library, but I'm going to omit it. So we can define such a map. Actually it's not just for G more people any for for any G variety. And this is history. So side of first defined map. Where the input consists of zero dimensional cycles. In the larger group, namely the base group of the Hamiltonian group. For anything better manifold and surface extended it to the to include our cycles of arbitrary dimension. So here's a lemma where we appear. We don't know how to compute, but we know it is a ring map. And it's proof by surface, which extend extending side of this argument. For the long equivalent case. So it originally they, they prove it only covariately. And you can vary the we can use localization to reduce to the situation where the inputs are consist of point or six point. But this equation is proof by Italy tiny. And it turns out that the map I've just defined CEO to PLS. So this proof gives an alternative proof of the results. Because we can pull it by theory. I don't know theory that it is a ring map, the right hand side is a ring back. And now we are able to compute this map. It turns out to be equal to PLS map. The idea of proof is that the more we can show that the more dry stacks are smooth and expected dimension. If the input cycles are both semaphones. Resolutions of the. I'm actually but varieties. So after doing that we can compute like how you don't work with compute or two point of common rhythm invariance. Here they used the fact that all the be always and be minus all this in the session personally to the final stack. Meaning to have an for some for their cases something like this. The final step here means we take a fiber product. And we do with some cycle representing, representing, representing the insertions. So this is the final step. And because of the transversality with the turns out that the final steps are smooth as on expected dimension, which is zero to the invariant will be to be computer by finding the number of elements in this deck. In the second of the borrow and opposite is still a continuous group. The stats will consist of. He invariant course. So that we can determine the stack computer really. And this is the same way how we compute. And this approach can take us further, because we can consider inputs different from the alpha and super classes. It turns out we can prove to Peter's and Verity presentation. And also we can consider an extra action on the alpha class money, which is loop rotation. And we can put it in the definition of software side those maps. And it turns out we can obtain the demo your mirror conjecture. So Peter's a variety presentation. I think it's also announced by Peter in MIT lectures. So roughly speaking is that we have a presentation of the quantum core module rain. We are why P is a scheme. And moreover, we know we can find expressive functions on the scheme which go to the quantum parameter under this isomorphism. So here's the definition of why P the pism variety. So first we start with. The land and use group of G. And later I will recall a practical definition of the land and do group. And then we have a principle important E and. Isomorphism between the. The cut down and do cut down. Then we can define the. Compatify, but I mean, I mean, I think this is what we call pism variety. So which is a positive variety defined this way. And our YP would be the. A stratum of the previous and variety. That means why cutting with some. And this result is proved for the foreign cases. Including all G mob B. That is complete flat varieties and all fair varieties of type A and some projects. Easy D. Skill varieties. So here's a practical definition of the land and do group. And because of it below and proof. Geometrics attack a conference. Which is a equivalent between. The representative representation category of land and do and. A category of parish chiefs on Lafeng Tasmanium. So in the course of their proof, they introduce. What we now call envy cycles of type lambda and new and wait, wait. New. Here. Let's say. Line the code letters, which is dominant. And meal also line the code letters. And it defines to be a closure of it's usable components of. Some of the set. It's like the. Attracting set. I mean, we, we. Consider flow on the Africa's money and then we consider the. Like stable manifold and stable manifold. An example is that. When the weight is the. W zero lambda W zero is the longest element. Then MV cycle. Would be the largest one. The closure of the spherical. I mean, the geo orbit. And if the weight is land itself, then the smallest. I mean, then the cycle would be the smallest one. Consisting of the point. And one important name is that. If we do loads. As. Lambda. By the highest rates. Representation. And we decompose it into. The rate spaces. It turns out that the rate each rate space. As a basis in that spider and recycle. Of type lambda and wait.  Wait meal. Here, I use as because he loves the sure module. Because everything was over integers and. In that case, I find sure model more. Convenient. And you choose isomorphism. Well, they use the geometric. To construct a ring isomorphism. From. The coordinate ring. Of the centralized group scheme. Of this element where we have seen this element. When we define piece of variety. So, so, I mean, I should give an example. So he is the. Is the matrix, which are all one in the off diagonal. An effect will be. Correspond to the. We correspond to the diagonal entries. And so B E T is a group centralize a group scheme of. Matrix of this form. So we have such a ring isomorphism. And this isomorphism has already been constructed by. And. There's a cutting off. Finger burn. But earlier, but without geometric satellite care. And one advantage of using geometric satellite case that we can. Compute it. In fact, Bowman can is a cruisin. Find that. And you use map. Sensor the matrix coefficient. To the fundamental class of the every cycle. Namely, so we. We have a S lambda, which is a representation. So we can take a consider the matrix. Like this, so that, so that the entries. Are regular functions on G. But we can restrict to B E T. And we look at the particular role. Corresponding to the smallest and recycle. So that is. The highest wage matter. And they show that the map send this. Regular functions to the fundamental class. So because. We have a, you know, we. We have a basic, right? So here's this matrix is taken with respect to this basis. So the input is, let's say, is that every cycle. And we can see that this, the entry sitting in this row. So that it sends the. Make this confident to. The fundamental class of set. So, so I've introduced. Another family of cycles. Other than super cycles. So we can ask when we compute. I mean, what, what, what if we input. The fundamental class of every cycle into a PRS map. It turns out we can do it for. For. If way. For this way. Well, so in this picture, they are. They are calling, right? Well, you see that it's not as it's not a large class. But turns out we can. We have some surprising application. So first of all, we observe that. If the weight of the enemy cycle. I mean. For example, let's consider all the ways. A kind red, except the, the vertex. Then we see that the dimension is quite large. It's larger than this number. And it's equal to this number is. The way I mean. The exact correspond to this word as. So we call this because this is an extremo weight. This is one dimension, the way space is one dimensional. So that is generated by one every cycle. Let us below this cycle by this. Set Wp W zero. Wp is the longest element. Of our fine. I mean the logo of P. We're going to play with this cycle. We give it a notation. Okay. So before the break, I would like to. Go for a few slides. So let's, let's go back to the surface side of the map. So we have seen this picture before. So we. We define some notation. We consider the moderate state of. The stable maps I told you before. And now the. The cycle output cycle will be denoted by C. And the gamma will be some resolution of the. Geo, I mean the closure of geo orbit. And there's a fact that. Well, if we consider M zero. You want P. We know that the moderate space is not. And if. When the degree. Light in the cone, right? In certain conspan by some code. For our case. It is. The set of degrees such that the. The. Moderate stack of sections. And it will be. The same phone, but with some shift. So it's no longer effective. But. But the effective. Shift. So this original effective. But now we. The cone will be shifted down to us going to the anti-dominant chamber. And by some computation. I mean some dimension argument we can show that. If we. With X. Oh, I forgot to say. For any X. Lying in the. The geo orbit. Closure. Lambda. Then. I'll met. When. Would be zero. If the decrease. Is sufficiently large. And when. Because in this case. All the moderate sets have no contribution. But there's some exception. It turns out that. There's only one. Moderates that. Contributing to. To. The computer invariant. So it turns out that this number would be some intersecting numbers. Intersection number. Of X. X. X. X. X. X. X. X. X. X. X. X. X. X. X. X. X. X. X. X. X. Y. Y. Y. X. Y. W. W. turn the PRS map will be zero. This is what we can see from the corollary. But I have to say that it's not very difficult to prove that from the component tolerance of the PRS map. We call PRS map is defined explicitly and we can actually use it to prove these results. Almost from definition. But what is press non-tribal is the computation of this interception number. We probably can't prove it easily from the definition of PRS map. So let's take a bit after I explain this slide. So what the the foreign puts Northbury's records but I find this is a good way to see why this is true. So first we determine this stack. It turns out it is first we don't concede for simplicity we don't consider resolution. Don't consider resolution but but the geo-orbit project itself it turns out that the stack is asomorphic to the some sub some orbit by some subgroup here error is the level of p to we have we inform the aphron-grasmaniac error which is a sub in-screen scheme of the aphron-grasmaniac g and we can take the orbit closure like this. We have such a isomorphism and and roughly speaking is proved by and why is this true because so recall we have a principal g bundle over this geo-orbit closure and if we restrict this principal g bundle over this aerobic closure the structure group will reduce from g to l and because e p is fixed by l so we have this map air equilibrium map and we can take the isociate fiber bundle and the left hand side for the left from the left hand side we can construct a section I mean for every point of this aerobic we can construct a section and then we map it into the side of space so that we get a map from right hand side to left hand side and we can use the regularity and dimension argument to prove that they are equal and so the next step is to show that the intersection number is one and we can consider the c-star action on a geo-orbit closure so let's just assume we have a bb decomposition but it is not true because it's not smooth but we can show that we can show that the largest one largest bb that exists so this is a a fiber bundle over the fixed point component and it turns out that the aerobic closure is is the fixed point component and our enemy cycle is a closure of one of the fibers of this fiber bundle so that the intersection is one yeah so here's a proof of yeah this equality so um I think I should pause it here for a break okay yeah all right yeah how long will the break take yeah we'll take uh maybe maybe three minutes break until five or eight okay yes


Hello, everyone. Good afternoon. My name is Tian Wang, and I'm a product manager with Pivotal, working in the identity space. So prior to joining Pivotal, I worked for over six years consulting with enterprises on identity and security. And I'll be talking to you today about identity from legacy to microservices. So just as an overview of the talk today, I'm first going to go through a brief history of identity in the enterprise and how it's evolved over time to where it is today. Following that, I'm going to give an overview of UAA, which is Cloud Foundry's native identity service, as well as the SSO service tile, which is a service broker that allows utilizing a lot of the capabilities of UAA. And then after that, we'll dive into a lot of the customer use cases that we've seen used out there for UAA and SSO, including a lot of how our customers have been able to leverage this to their advantage. So first, just a primer about identity. Identity is something that all companies have to take care of, whether you're talking about customer users or your employee users or even your service-to-service applications. Identity is one of the cornerstones of security in that it's something that you need in order to be able to authenticate and authorize users for your applications. So this is something that almost must be there from a security perspective. But identity itself has been something that's evolved over time in the enterprise. People started to realize the importance of identity over time and just how much of it they need. And as a result of this, the way that identity has been implemented as solutions within enterprises has changed over time and adapted for what the needs have been. So in the beginning, people had their applications and, hey, anyone could access your application anywhere. And someone started to realize, isn't it a good idea if I check who's accessing my applications and I can secure them somehow and prevent malicious people from doing bad things to my systems? And that's kind of how the identity came to be as a concept for applications in the form of local user stores. And this made sense because application developers could build it for their applications. They could basically take whatever they needed to have and build that towards their apps and store it wherever was convenient for them, whether that was a file, a database, a directory. And that was very simple. You could set it up in a development environment. You could get up and running right away. Now, this works great when you're talking about a single application. But as you start to be kind of an enterprise, you realize no company just has one single application. That's going to grow as you start to build out more and more applications. So when you have hundreds of different applications, this is not going to be a maintainable model because you're going to be duplicating users across a lot of these applications. And your application developer is going to be thinking, well, I want to do it this way. But they did it another way. And there's just no agreement among how to do it. So you have all of these different implementations that are being reinvented. So you're basically reinventing the wheel over and over again. And when you have all of these applications with their local user stores, people are going to have to remember different logins and different passwords. And what do people do when that happens? They start reusing their passwords. So now you've got a security issue as well where everyone's trying to reuse their passwords and logins, or else they're going to forget about it. And you're going to have to spend more on password resets and all of those items. And this is going to get very expensive to manage. Because not only do you have different applications out there that have their own users, you have to go in and change those users, remove their access, do password resets. And I don't know if any application developer has ever said, I want to build an admin interface for my users for support to go in and change people's passwords. So this is not a scalable model across enterprises. But this is kind of where identity first started across companies. So as enterprises began to mature in the area of identity, they realized that since we're one single company, why can't we just have one user store, one location, where I have all of my users and all of their data and all of what they need. And all of my applications can use that. So that's where enterprise directories came into play. And this would be something like an LDAP server, like Active Directory, where you would basically share your users and passwords for all of your corporation's applications. You could manage and deprovision in one central place. You'd be able to basically handle the applications within your company in a more straightforward fashion. So this was a good model. And it made sense for many, many years. Companies still might be in this state today. But as companies began to kind of evolve in the technology area, there became more and more of a need to work with other companies, suppliers, partners, hosted applications, things like that, that are going to have separate users or separate applications that your users need to access, where their users need to access your apps. And that's where this no longer became a good model for sharing users, because you didn't know whether or not you could send your users to them. You might have firewalls that make it hard. You don't want to open that up to the world. So this then runs into the same issues that we had with the user stores that were local, in that you're duplicating a lot of your users. You're having a lot of the data. The management issue becomes an issue again. And do you share your sensitive data with other people? Like if you give someone else your passwords to your users, aren't they just going to get hacked and then go into your company and take all your stuff as well? So this is not something that can work across a lot of different enterprises. So as a part of this kind of dispersion of identity into different companies then, this idea arose that, hey, we should be able to federate users from other companies or federate our users to other companies so that we're using each other systems, but we own the data that we should be maintaining. So SAML 2.0 came out as the leading standard for federation. This is like early 2000s. And that really became a way to then say, this is my user. They're logging in at my location, so I have all of their data, all of their passwords. And I'll just send you an assertion or a claim that this person is who they say you are so that you don't have to maintain of this any data for me and I don't have to worry that all of this stuff is being left on your side. So not only are you keeping a lot of that security safe, but you're also able to manage your users and take care of how they're being the lifecycle of that user without having to worry about other people. So this was very good when it first came out for the web apps that were built during that age. But this model doesn't really handle beyond the case of web applications. So yes, you could log in towards a monolithic web application and it would be able to federate with other companies. But it doesn't really handle non-interactive flows. It's something that also doesn't really work for service-to-service calls because it's really you're logging in through a browser. It takes you to a login page. That doesn't work with CLIs. And it doesn't work between the services. So a lot of these weak points then became kind of a these worked back in the day because a monolithic web application could support that kind of thing and things worked. But when you started to get more and more API usage on the back end, you found that you could no longer use this model sustainably as you start to grow in terms of your API ecosystem, especially in kind of a microservices-oriented world. So this was definitely not microservice friendly. So as that kind of evolved within the businesses out there, OAuth 2.0 came into being. And this was really something that was geared around distributed systems and federating users among enterprises. It handled both the user flows that were out there and still had to be supported. But it also extended it for API-to-API calls so that you could do a lot of these things non-interactively. And it used delegated authorization as well to help you manage that security as you gave these out there to other entities. So this was kind of a good step in terms of microservices friendliness. But one thing that was not really addressed in the initial spec for OAuth is that they didn't cover how authentication would work. So this kind of arose as an open question of, well, how should I be authenticating my users? Because the spec doesn't really talk about that. So then the last step then to bring authentication also in line with authorization came OpenID Connect. And that was essentially a standard built on top of OAuth 2.0. So when you're building something that's OpenID Connect compliant, you'll also be using OAuth behind the scenes. And it established the standard of an ID token that said, this is how I should authenticate a user and this is how I should represent that it authenticated successfully. And so that was basically then something that finally brought us to where we are today in terms of what are all the protocols out there that support identity in the ecosystem. So businesses, of course, are still changing today. And we're still seeing that movement towards more and more distributed systems, more ecosystem proliferation, more microservices architecture out there. But one of the main pain points that are out there is that companies have heavily invested in various stages in these past ways of handling identity. So they're going to have spent a lot of time and effort on developing these directories or these integrations that essentially bottleneck them towards moving towards cloud-native architecture. And it gets very expensive for them to then become more agile and secure in the identity area. And that's where we at Pivotal have approached this with the UAA and the SSO tile to address a lot of these pain points that exist in the businesses out there. So the three main pieces that we put together when we tackle identity is the UAA, which is the open source identity service for Cloud Foundry. And it handles authorization and authentication today. So it'll basically support authentication via SAML, LDAP, and OpenID Connect. And it's also an authorization server that's compliant with OpenID Connect and OAuth 2.0. And what it does then is it allows you to convert a lot of these legacy authentication protocols into new age OAuth and OpenID Connect compliant tokens for your applications to use. The second piece that we brought in was the single sign-on service broker, which uses entirely UAA and Cloud Controller functionality. So if you're thinking that this isn't something you can achieve on your own, it actually is. It basically makes it a lot easier for operators to configure UAA by handling a lot of the multi-tenant policy configurations and a lot of the overhead that comes with using that in the open source site today and makes it available as dashboards for the operators to use. For app developers, it helps take that experience and make it self-service for app developers so that they can go in and manage their application clients, their OAuth configurations themselves, without having to work with IT and go through a lot of red tape to get that done. And SSO also helps the app developers in that it integrates with a lot of different frameworks, such as Spring Boot, to basically take the configurations and map those into the frameworks so that you're no longer worrying about that piece of integration, which is always the question at the end of it. And where Spring Boot comes into the picture, then, it is that it is one of the frameworks that we support to help application developers have a framework on which to build their applications in a secure manner. Spring Boot comes with OAuth libraries and OpenID Connect libraries as ways to help developers get started. And it manages a lot of configuration of those through auto-configuration and other concepts that basically help a lot of application developers not have to worry as much about managing identity within their apps. So how does this look put together, then, within the Service Broker, UA and Spring Boot itself? So what happens first is then an operator will go in and create an integration with the Enterprise Identity Federation systems. So this can be any system out there that's kind of a standard Enterprise Identity Source. With that, they'll be able to make it available for the application developers on the marketplace as basically service instances that can be bound to their applications to run. And basically, from this step on, the Cloud Connector that comes with SSO will help to do a lot of the automation of security enforcement and runtime and basically map that into Spring Boot in the form of declarative code that the developer can use in their apps. And with this combined, then, it allows a lot of autonomy for developers who can basically work on this on their own and develop within their own spaces and not have to go through IT for a lot of these things and also increases the productivity in terms of being able to build out applications fast. And this can be used for user flows, service-to-service flows. And you can also start using our latest feature, which was recently added to UAA for Token Exchange to handle a lot of those service-to-service API halls. Now, the typical end-to-end flow of a lifecycle then as a part of this flow is that whenever a user or an application, it could be a separate application or maybe even the application calling on its own behalf, wants to then request authentication and authorization, it's going to first make a call to the UAA and the SSO service, which will then, if necessary, broker that communication with any of your identity providers. This could be a legacy LDAP server. This could be some kind of SAML ADFS or SiteMinder if you have those. And it might also be able to help with your OpenID Connect providers like, say, Google. You want to integrate with that. Once the user is logged in, and it could also be an internal user, we support those as well, we send a token back to the client or the application that can be used for downstream API calls. And this is where you start kind of working in a more microservices-oriented architecture in that you can have your resource servers or your API sitting in any location. It could be on Cloud Foundry. It could be off Cloud Foundry. But these same tokens can be used by these API servers. And these API servers can check back into UAA and say, is this token valid? Or they can do it with offline validation through token keys that are provided from the authorization server itself. And with this kind of model for a single instance of application and number of APIs out there, you can provide your applications with microservices-friendly identity. Now, what are a lot of the benefits then that exist across the different personas as a result of combining UAA, SSO, and Spring Boot? So for operators, there's a lot of benefits that come natively within Cloud Foundry and BOS, just because UAA is one of the Cloud Foundry components in there. So you're going to have zero downtime upgrades and a lot of the operational maintenance pieces provided. For app developers, of course, we have the self-service capabilities that makes it very easy for you to configure what you need for your app without having to worry about others. And you can integrate with frameworks that will help make it easier for you to build your applications. And finally, for security administrators, this really becomes a powerful item in that you're able to leverage your existing identity provider where you've built years and years of users and data and policies and compliance items that you don't necessarily want to take somewhere else. And we provide guides and things like that to help you integrate and set that up and basically start using that without bottlenecking your developers who can then start building against those right away. So some of the common use cases that we see out there on how single sign-on and UAA are used, first one being, of course, application onboarding. So this could be new applications that you're building for the first time on Spring Boot, or this could be legacy applications that are already integrated with an identity provider you have out there. And now you want to move them onto Cloud Foundry, make them cloud native. So the main thing is we only require that your applications be OAuth aware. And this can be done through frameworks such as Boot or any other libraries that you have out there. And we help take the legacy protocols that you have out there and convert them into tokens for your applications to use. And this really gives an ability to allow for fast migrations and fast development. So in one example, we had one customer that was able to onboard 20 applications in the course of six weeks with their legacy identity providers. A second common case that we see out there is that as there are more and more companies who are doing business with more suppliers, business units, more partners, you're going to have a lot of different identity providers that are providing disparate user sets for your applications. And this can be a pain to manage, especially because you don't want to build your application to talk to five or six different identity providers, set up all those integrations, and maintain those integrations. So through the multi-tenant self-service architecture that UA and SSO provides, essentially you can define a lot of these integrations once and make them available through the service marketplace, either as configurable items for them to select or if you have to restrict them, kind of disallow them from certain orgs or spaces. And only then the appropriate people can use the corresponding identity providers they need. And lastly, of course, is another use case, which is less common, but still happens very often in the enterprises, switching identity providers. So identity systems change pretty often, and that leads to very expensive rewrites of applications. And most of the time, this is not something that's handled by application developers, but it lands on the application developers plate to be able to handle these types of situations. What happens when you have this kind of a service broker idea in between your identity providers and your applications is that not only can you build your applications to be cloud native, but you're also protecting yourself from the impact of upstream systems changing and kind of putting a lot on your plate to handle in terms of that integration. So this is definitely something out there that we've seen customers leverage when they're using the UAA and SSO as an identity broker for their applications. Now finally, of course, I like to just wrap up with some tidbits from a few of the customers who've been using UAA and SSO over the years. So the first customer is a company called Manulife that does financial insurance work out in the United States. And they've been using the SSO service for the last one and a half years. They have over 100 applications that are bound to the SSO service. That's both a mix of new applications they've developed and applications they've migrated from legacy builds. They have 200 to 300 active developers across PCF, and all of that is managed by three operators, including management of the SSO service tile itself. Prior to moving on to the SSO service in UAA, they were primarily using IIS and IWA to connect to an AD backend. And they had very limited RBAC capabilities for which they required a lot of red tape to go through IT and setup. And that could take days or weeks to get done. After they were able to migrate onto PCF and the SSO tile, they began to use SAML via ADFS to connect with their AD backend, so leveraging the same set of data that they did before. Their developers began to be able to use that self-service UI to create their OAuth clients, configure their scopes and their groups and what they needed to do their business logic. And without IT being in the way, that whole process went from weeks to days in some cases. And as a part of this process as well, their developers began to use Spring Boot. And even though Spring Boot abstracts the concepts of OAuth for you at the implementation level, it helped them to learn about how to build cloud-native applications that leverage OAuth in a microservice-friendly fashion. And one item that they're definitely looking forward to is that in the future, if they do change their enterprise identity source, and that's a possibility, but as always it's in talks, then they'll be able to do this without impacting the applications that they've already built on top of the platform. And lastly, I'd like to conclude with a quote from one of our other satisfied customers, General Motors. So this is a quote from Matt Brooks, who's their GM IT fellow for cloud platforms. Pivotal single sign-on service tile provides a trusted on-demand connection between our cloud applications and General Motors identity providers. Offered directly from the Pivotal cloud foundry services marketplace, the SSO service plans eliminate the need for per application trust and removes hours from the traditional deployment process. The SSO tile reinforces our Galileo initiative to spur innovation by having developers focus on code, not infrastructure. So in conclusion then, UA and SSO is something that we believe kind of help tackle a lot of the pain points that exist out there between kind of the legacy identity and how it was handled in enterprises and where people want to go in the future. You can learn more about the UA and SSO service at the links provided here, and feel free to reach out to us on CF Slack or Pivotal Slack as well. If you have any questions, we're always there to help support you guys. And we always, of course, on the open source side, appreciate contributions because there's always more out there than there's always ways to make identity better. And it's very helpful as well on the open source community to help improve that overall experience. Thank you. So now I'll go ahead and take any questions. Yes? Is there an easy way? So if I have an unusual identity provider, how easy is it to write a, I don't know how it works, a plugin or a module to integrate it with UAA? That's a good question. Is there any specific protocol or thing in mind that you're thinking of? That's a good question. And I don't think we've quite explored that on the front of that. But we have had open source contributors provide integration options into the UAA platform before. Like, the entire SAML piece was, I believe, donated from an open source contributor. So it's not unusual for us to see that come in through the open source channels. So how do you want to do the integration? UAA has a set of protocols. So it has the OpenID Connect protocol. It has the SAML protocol. It has the LDAP protocol. And therefore, if you're looking for integration through those protocols, then you can just do it by providing an implementation of one of those protocols. Mm-hmm. Right. And then if it's a new protocol, that's somewhere where it might be some new feature or pull request against the UAA GitHub. Hi. One question. We have Cloud Foundry, of course, running. And my question is, this has already in UAA. What do you propose should we, to be an identity provider, create that platform, use a different UAA, deploy it again on Cloud Foundry itself, or use the build in UAA and just align that? Actually, we wanted to split this Cloud Foundry users from the actual identity provider. Right. That's a good question. And what we recommend here is that with the UAA that already comes with Cloud Foundry provides the ability to use kind of multi-tenant identity zones to supply a lot of that functionality yourself. And that is the piece that the SSO service leverages. And what we tell clients to do as well with just UAA on its own so that you can kind of save a lot of the overhead of deploying your own UAA and kind of take advantage of what Cloud Foundry provides already with Bosch. Can you run UAA outside of Cloud Foundry? Because we're basically looking for an open ID connect server. And all of the offerings are not very nice to use yet. So you can run UAA outside of a Cloud Foundry. That comes with kind of overhead in terms of maintaining the upgrades and doing a lot of that operations piece yourself, which something that comes with kind of having an outside of Cloud Foundry. So it's something that's definitely possible. But one of the things that we kind of like don't recommend as much in case you already have Cloud Foundry available. So if there's no more questions, thank you for your time. Happy to answer any questions up here as well after the talk.


For more videos on people's struggles, please subscribe to our YouTube channel. Hello and welcome to Dispatches from India, where we bring you major news developments from the country. Today we look at the shocking death of an activist, the fate of an innocent man who was in jail for 11 years under a draconian law, and the concerns raised by food delivery workers in the city of Chennai. We begin with the death on Monday, that is July 5th, of activist and priest Dr. Stan Swamy at a hospital. 84-year-old Swamy was India's oldest political prisoner and was suffering from Parkinson's disease and had also contracted COVID-19 last month. He had worked for decades for the welfare of tribal communities in the country and was widely respected for his conviction in gentle demeanor. He was arrested in October in the controversial Elgar Parishad case. The case has to do with violence in the state of Maharashtra in the beginning of 2018. While right-wing groups were initially identified to have been responsible for the violence, over time the government began to claim that there was a left-wing terrorist conspiracy. Under this case, 16 academics, activists and writers, including Father Swamy, were arrested using the provisions of the Draconian Unlawful Activities Prevention Act, which makes the grant of bail very difficult. The case has been widely criticized as an attempt by the government to crack down on dissenters in the country. From the time of his arrest, Father Stan Swamy faced a lot of difficulties in prison. He had to approach the court to even get a straw and a zipper, which he needed due to suffering from Parkinson's disease. His earlier attempt to bail was denied, even as his lawyers and friends listed how his health was deteriorating. On Monday, when he died, a court was hearing his bail plea. But it was too late for Father Stan Swamy. Across the country, voices of anger and criticism have arisen against the treatment of this 84-year-old man who remained in jail till his death, despite not being convicted of any crime. We bring you this response from Senior Journalist Bhasah Singh. We lost Father Stan Swamy. It's a personal loss for me and to many more in India. He was a activist. He was a tribal right activist. He was a human right activist. And above all, he was a very humble soul. I have been personally following him from more than a decade. I have seen his work very closely. He was arrested on 8th October 2020 under UAPA. He was charged with a Bhima Kuregaon case.  He was involved in a bigger conspiracy against Indian state and to which he stood very firmly, said that no, he was working for the people. He was working for the poor people of the tribal belt of Jharkhand. And the way that things have happened that shows that how Indian judiciary has not given, not done justice to this person who throughout his life was working for the marginalized. He was continuously his lawyers and he himself was demanding for a bail. And we know that judiciary failed in this matter utterly. In the last hearing, in the NIA said that he was not suffering from something very dangerous. And after that, he was admitted to the hospital and finally to the ventilator and he passed away. I just want to read a few texts which he said openly when he was arrested and that shows his commitment to the cause. I will read a text. It is a part of a video which was circulated two days ahead of his arrest. In this, Stain Swami was speaking. What is happening to me is not something unique happening to me alone. It is a broader process that is taking place all over the country. We are all aware how prominent intellectuals, lawyers, writers, poets, activists, students, leaders, they are all put into jail because they have expressed their dissent or raised question about the ruling power of India. We are part of the process. In a way, I am happy. In a way, I am happy to be part of this process. I am not silent spectator. I am not silent spectator, but part of the game and ready to pay the prize, whatever, be it. And we have seen that he paid the prize from his life. The way the things turned in Taloja Central Jail, the way he was writing to his friends, the way he was just demanding that he want to go back to Jharkhand to his place so that he can take rest properly. He was not even willing to go to the hospital in Mumbai. But this whole thing happened in Mumbai. Everything was present, reported, everything was coming openly. And we have seen that the whole Indian structure, the legal structure, the political structure, not only kept silent, but they were part. They were part that this fellow finally perishes into death. And definitely, all those, rest 15 who have been arrested in Bhima-Koregaon case, I don't know what is their fate, but definitely it's a sad day. It's a sad day for Indian democratic structure. In our next story, we continue with this brutal law, The Unlawful Activities Prevention Act. On June 19, the court in the state of Gujarat acquitted a Kashmiri man, Bashir Ahmad Baba, who was booked under this law that's UAPA. He was allowed to go home after the court founded the charges against him, which would have seeking to establish a terrorist network had not been proven. What Baba lost in this process was 10 years of his life in jail. He was arrested in 2010 from Gujarat where he had gone for training to set up post-cancer care services and he was declared a terrorist. News click talked to Bashir Ahmad Baba on this harrowing experience. We knew that this was a crime. Now, when this crime is proved, it takes time. And above all, this is the matter of the court.  What feeling comes. These things keep people away for 12 years. After 12 years, they come home. And in our final story, we go to the city of Chennai in the state of Tamil Nadu, where we look at the plight of food delivery workers who face a wide variety of challenges. On the one hand, their workload is increased massively due to lockdowns. On the other hand, fuel prices have been increasing across the country, putting an extra load on them. Many of these workers are not able to even access their basic rights. We bring you testimonies from some of them. We are running. But we are running for three hours and four hours. In the coming new year, they have given us an order to earn 45,000-50,000 rupees. They have given us the ability to do the work that everyone has to do. Now, we are unable to earn the money that we have now. We are running from one location to another. We are running out of petrol. We don't even get water. They don't even thank us for the food that we are giving them. They just look at us as if we are getting food from outside. They just look at us as if we are getting food from outside. Delivery persons have become an intrinsic part of bustling metro cities like Chennai. While various state governments in India have sought to control the second wave of the COVID-19 pandemic through lockdowns, the role of delivery persons in providing food to people have gained even more importance. Further, with the unemployment rate touching 6.9% in February this year, as per the data of the Centre for Monitoring Indian Economy, more people have turned to this sector seeking jobs. However, the issues faced by these service providers amid the pandemic-induced lockdown have not received the necessary attention. The hike in petrol prices, with the rate crossing the Rs 100 per litre mark in many cities, have added to the distress of those engaged in delivery services, as motorcycles are a basic necessity for these workers. Not only that, workers have also raised complaints that corporate delivery platforms like Swiggy, Zomato, Shadowfax and Dunzo exploit them by paying a meager amount as salary. News clicks spoke with a few workers to find out more about the issues faced by them.  I was a supervisor in the University of India. I am now a Zomato student because of my hard work. I am not educated or social knowledge. I have a lot of social knowledge. You have come to me for a long time. Now, I am regularly riding a cycle. But a few days ago, we were sleeping here. I am a printer. I was designing printing press. In this lockdown, I could not afford to get a loan for the last year. I had a commitment. I had to study for the students. I had to live at home. This month was very difficult. So, this is the business that is running. That is why I joined this business. Because, it is only for petrol for half a month. Because, it is a new place for us. It is very good to go to the map. If you go to the map and find it, you can get the money and come back. One day, you cannot do more than 10 orders. Even if you do more than that, they will finish the story in 12 days. That is why it is very difficult. We are doing it without any other means. I am a mechanic. I did not get a job in lockdown. I came from abroad. I joined the recent business in the capital. The petrol costed Rs. 100, Rs. 99, Rs. 98, Rs. 59. I used to pay Rs. 200 in the morning. I used to pay Rs. 100 in the evening. I had to pay Rs. 300 in the morning. If I had to pay Rs. 590, I would have to pay Rs. 300. If I had to pay Rs. 290, I would have to pay Rs. 290 in the evening. I had to pay Rs. 200 in the evening. If we had to go for 1 km, they would pay Rs. 625. If we had to pay Rs. 590, we would have to pay Rs. 625. They gave us an amount before the lockdown. After the first lockdown, they reduced the amount. Why did they reduce the amount? They said that the company is going to the last. Now, we have been protesting from somewhere. They said that they will give you an order within a limited kilometre. During the Covid-19 pandemic, we were delivering tomatoes.  If I were to say that Covid-19 is positive, I would have to intimate the company. They told us that they would not come to work for 2 weeks. They told us that they would pay Rs. 500. No, we do not indicate the corona patients. We do not indicate our app. If you look at it, there is an option to say no contact delivery. If there is no contact delivery, we should not go to them. We deliver to the corona patients. If they do not know the option while they are in quarantine, they normally order. We directly deliver to them. We do not see it at all. We do not treat the corona patients. If someone in our house orders, we go and deliver quickly. We return as soon as possible. They do the tomatoes. I earn Rs. 1,000 a day. Do you know how much it is? I earn Rs. 1,000 a day. But they are telling me without a reason. Because the city is here, this is the demand. So, there are young people like me who study here. When there are 100 people, 100 orders are correct. First, there are thousands of people. There is a job for 100 people. There are only 9,000 people sitting here. I would have taken 10 orders in the morning. But if you do not have time in the lock-in time, they will put half the money and half the money. When we say that, we are wasting our votes. Is there any way to tell the problem? There is no way to tell it, sir. There is no one to tell it. We are talking to a computer even if we make a ticket in the app. But when we share it with a human being, they will know that it is their problem. That's all we have time for today. We will be back next week with more news from India. Until then, keep watching People's Dispatch.