location_city Melbourne schedule Jul 30th 02:45 - 03:30 PM AEST place EN101 L100 people 31 Interested

API development is fun! Everyone is doing it, from large organisations wanting to provide developer access to their systems, to small websites wanting to push web application business logic to the browser.

Password security is boring. It's also harder than you'd think. The number of reported system breaches is on the increase, with big names being hit by hackers.

And when it comes to a service-oriented architecture, you have to secure multiple services. That's just tedious.

There are a number of solutions, but few that let you pretty much forget about security and access control.

In this talk and demo, Ben will show how using a third-party identity management system will allow you to ramp up your prototypes and MVPs with more ease, and to concentrate on the core purpose of the APIs, rather than the layers of security that are a must in today's digital world.

 
 

Outline/Structure of the Talk

Description of a typical user login flow

Let's look at how this flow scales

Let's expand the infrastructure to support a service-oriented architecture and native mobile apps

Single sign-on and Active Directory support?

Suddenly, our home-grown authentication systems look very complex indeed

Let's look at how a separate identity solution, self-hosted or otherwise, can help

Finally, a demo to see how you would integrate Auth0 into your application

Learning Outcome

You will:

  • gain an understanding of OAuth and Open ID Connect to authenticate and authorize a user,
  • learn about the use of claims and scopes to control access to certain features of a system, and
  • see a live demo of how to integrate Auth0 with a common API platform.

Target Audience

Software Developers

schedule Submitted 4 years ago

  • Alex Sloley
    keyboard_arrow_down

    Alex Sloley - The End is Nigh! Signs of Transformation Apocalypse

    45 Mins
    Talk
    Advanced

    How can an Agile Coach figure out when an Agile “Transformation” is going wrong? Are there signs that they might see, heed, and take action upon? Of course, there are!

    Hindsight is 20/20, but in the moment, these warning signs can be hard to see. Let’s explore some of the more common, and frightening, warning signs that your Agile “Transformation” might be exhibiting. We will discuss transformation provider types, frameworks, keywords, and other anti-patterns that might be signs that THE END IS NIGH.

    This session will review common themes and help familiarize you with the warning signs. Armed with this new knowledge, you will be able to plan as appropriate, to help navigate your organization through potential impending doom.

  • Nish Mahanty
    keyboard_arrow_down

    Nish Mahanty - Moving from a monolith to a distributed monolith - a cautionary tale on adopting microservices

    Nish Mahanty
    Nish Mahanty
    Director of Engineering
    REA Group
    schedule 4 years ago
    Sold Out!
    30 Mins
    Talk
    Intermediate

    This talk is a case study of our architectural evolution over the last 2 years.

    Our start-up had licensed a customised warehouse management system in order to demonstrate our innovative new business model. The WMS had a traditional 3-tier architecture based on Java and SQL server, and was lightning fast with most of the business logic encapuslated in stored procedures.

    Out our start-up we needed to be able to "test and learn" - ie rapidly develop and deploy new features and test them in the market with our customers. Based on the feedback we would identify tweaks to the business model, and fine-tune the functionality that our customers wanted.

    We had a launch date 5 months in future, a need to scale rapidly, growing the team from 2 devs to 20 within 8 weeks. And we needed to be able to work in parallel on multiple features. Whilst ensuring that the application was secure, performant, and reliable.

    The answer, according to a bunch of experts, was to adopt microservices.

    Three years later, we have a suite of secure, scalable, and resilient applications running in AWS. We deploy to Production multiple times a day, and our MTTR is less than 30 minutes.

    And we have Services. Some of them are "micro".

    But reflecting on what we learned in that period, there are a lot of things that we wished we had done differently.

    In this talk I'll walk you through the evolution of our architecture, explain some of the choices, and highlight what we learned, and discuss what we would do differently if faced with the same decisions today.

    This case study talks about the last 9 months of our start-up where we went from “no team, and limited functionality” – to launching a successful and thriving business backed by completely custom trading platform and fulfilment engine.

  • Justin Holland
    keyboard_arrow_down

    Justin Holland - Cultivating quiet: The death of the need to always DO (Working Title)

    Justin Holland
    Justin Holland
    Senior Business Analyst
    Xero
    schedule 4 years ago
    Sold Out!
    30 Mins
    Interactive
    Beginner

    I wrote this blog a short while ago: https://medium.com/@justin.holland/cultivating-quiet-38cec9466feb

    I feel like there are other continuous improvement addicts, or perennial impostor syndrome sufferers that feel the compulsive need to be more than they are, and do more in order to reach that unattainable perfect state of being...

    And I know that a bunch of us find ourselves in a state of constant information processing & overload... thanks to the infinite information we are exposed to every day.

    I have also come to believe this can be super unhealthy, and that there is something fundamental that we are losing, thanks to our perpetual busyness.

    Some come and have a little chat, and reflect, about the role of not doing... and instead... being... (quietly)

  • Daniel Prager
    keyboard_arrow_down

    Daniel Prager / Andi Herman - When at first they don't want to change: Shared lessons from Addiction Therapy and Agile Coaching

    45 Mins
    Talk
    Intermediate

    The easy case for coaching looks something like this: a prospective coachee wants to change, can articulate their goals, and is matched up with a suitably experienced and competent coach, the two are a good fit, and they quickly get down to the challenging yet rewarding business of growth and change.

    But what if a person (or team) doesn't want to change and would rather not be coached? And despite this an external power deems that change is needed and that coaching will bring this change about. What's a coach to do? What about the coachee(s)? What about the role of the client who's engaged the coach?

    This situation is not uncommon, and bears more that a passing resemblance to what often goes on in addiction treatment. A person with a drug addiction (and often other problems) doesn't necessarily welcome therapeutic intervention at the outset. But an external authority has ordered it.

    In this session we will explore the parallels between the two modalities of addiction therapy and coaching, including the applicability of the Transtheoretical Model of Change and the related technique of Motivational Interviewing.

    These approaches offer insights into how to flex and adapt your coaching approach in the face of some of the most common human impediments to change.

  • James Holmes
    keyboard_arrow_down

    James Holmes - "Agile Software Development actually involves writing software," and other shocking facts.

    30 Mins
    Interactive
    Beginner
    This presentation will focus on the some principles that have been largely ignored in the way we teach agility to people:
    • "Working software is the primary measure of progress."
    • "Continuous attention to technical excellence and good design enhances agility."
    • "Simplicity--the art of maximizing the amount of work not done--is essential."
    We'll cover these by bringing Extreme Programming (XP) up-to-date. We'll also go over software design principles and practices that help, including:
    • loose coupling and tight cohesion
    • declarative programming
    Expect to see actual code running on an actual computer at some point.
  • Kelsey van Haaster
    keyboard_arrow_down

    Kelsey van Haaster / Peter Lam - Agile and Management - a conversation

    45 Mins
    Talk
    Advanced

    Agile was coined in 2001, building on techniques and methods from the prior 10 or more years. We know that (smaller) software projects are more successful with agile delivery methods than with staged approaches like the SDLC. So why is it that 18 years after a better was was identified that managers struggle to adopt agile in a meaningful way.

    This is a facilitated discussion - there are as many answers as there are people! So with the late afternoon timeslot - let's get together and have an interactive chat - with the intent that we all leave with some useful ideas, tools and techniques that we can apply when we get back to the office ...

  • Alexis Stuart
    keyboard_arrow_down

    Alexis Stuart / Bob Martin - What Aren't You Seeing in Your Product Organisation? Lesson's Learned on Myer's Digital Journey

    45 Mins
    Case Study
    Intermediate

    At Myer, we’re well into our digital product journey. Although we still have plenty of work to do, we would like to start sharing our experiences in taking a Product centric approach to ensure we are delighting our customers and leveraging L.A.S.T practices to change behaviour and enable a positive outcome.

    In this discussion, we will look at where we started, where we are now, and what our future path might look like. Our hope is that we can help others avoid (or at least identify) some of the more common pitfalls, and to help others develop a proactive approach to navigating their digital product journey.

    Some topics for discussion may include:
    - How we are working on creating a Product-centric organisation, and why this is so important.
    - How focusing on the work that feeds the backlog(s) is just as important as the backlog(s) them self.
    - Experimenting with the Google '20% time' practice, and how this helps create a trusting and inclusive environment.
    - Constantly questioning the value of ideas, and initiatives. Like many organisations, there is no shortage of great ideas, but how do we make sure we are working on the most valuable ​at any given time?
    - What happens without a strong product organisation? For example, what happens when there is no product guidance for UX. Now that we are working on building out our Product practices - how can we ​start to develop a healthy tension between UX and Product?

    Experiences shared by Alexis Stuart, Digital Product Owner and Bob Martin, Agile Practice Lead.

  • Gabor Devenyi
    keyboard_arrow_down

    Gabor Devenyi / Jayavalli Vadrevu - Agile in Action - Build a Paper City

    90 Mins
    Workshop
    Beginner

    This is a practical workshop where the participants will work in two sprints to build a city using the material given to them.

    The intention of this workshop is for people to understand all the ceremonies better and it also helps teams understand that collaboration and working together as a team is the best way to achieve the results.

    This is going to be a very interactive workshop while teams get to learn Agile while having fun.

  • Neil Killick
    keyboard_arrow_down

    Neil Killick - Slicing heuristics - Techniques for improving value generation, speed to market and delivery predictability

    60 Mins
    Interactive
    Advanced

    Story (or, more accurately, capability) slicing is such a core and necessary practice for creating agility at team, portfolio and even organisational level. Yet it is not explicitly included in any of the popular methods and frameworks teams use such as XP, Scrum and Kanban.

    Slicing heuristics are collaborative, contextual, evolving techniques for creating focus on value-generating activities, leading to delivering value sooner and with more predictability. They incorporate all of the 4 core agile values from the manifesto, and many of the 12 principles, particularly:

    • continuous improvement (inspect and adapt),
    • maximising the amount of work not done (simplicity and focus)
    • face-to-face conversations
    • continuous delivery of value

    Best results are obtained if heuristics are applied for all types of work, by all of the folks collaboratively across the value chain, but they can be used as safe-to-fail experiments by individuals and groups wherever they sit in the product delivery pipeline.

    From a practical perspective, they involve:

    • slicing deliverables at all levels, not only "story"
    • flow metrics (cycle times and variation)
    • specific inspect and adapt / continuous improvement activities to improve speed-to-market and predictability
    • big visible boards (ideally)

    Come and learn about this powerful, practical approach to improving agility in your team or organisation from wherever you sit right now.

  • Steve Mactaggart
    keyboard_arrow_down

    Steve Mactaggart - Designing an effective CI/CD workflow

    45 Mins
    Talk
    Beginner

    In this session we will take an introduction look to Continuous Integration and Continuous Delivery workflow.

    This session is an introduction session to CI/CD and is best for people new to the CI/CD concepts, or looking to brush up on benefits of using these approaches.

  • Neil Kingston
    keyboard_arrow_down

    Neil Kingston - Do project managers still matter? | A Case Study

    45 Mins
    Case Study
    Beginner

    For many Agilist the idea of having a project manager attracts scorn and derision. The idea of having one at is laden with bad memories, mental baggage and principled objections.

    So, is there a role for a project manager in an Agile organisation? There is, but it requires a different style of project manager and a project manager that thinks differently.

    My company’s ongoing transition from project-based delivery to product-led Agile delivery runs in parallels to my own personal transition leading a team of project managers into this world.

  • Igor Goulko
    keyboard_arrow_down

    Igor Goulko - DevOps is not an option anymore, it's a door for your IT success

    Igor Goulko
    Igor Goulko
    Founder
    DevOps Talks
    schedule 4 years ago
    Sold Out!
    45 Mins
    Talk
    Intermediate

    Today, almost everyone talks about DevOps but not too many understand what's it and why all companies need it. I will provide real examples of what's not DevOps and what it is.

  • Alex Sloley
    keyboard_arrow_down

    Alex Sloley - Dammit Jim, I’m an Agile Coach, not a …!

    45 Mins
    Talk
    Beginner

    Just what exactly does an Agile Coach do? Coaches may vary in their response to this question. I would like to think that most Agile Coaches, with some variation, would be fairly consistent in how we perceive our role. However, some companies or orgs or people probably interpret the role of the Agile Coach in ways that coaches never intended.

    Let’s explore some of the things that Agile Coaches have been asked to do! Are these antipatterns? Doing what needs to be done? This session will delve into the topic of the role of the Agile Coach and highlight potential challenges and possible solutions.

  • Ben Dechrai
    keyboard_arrow_down

    Ben Dechrai - A token walks in to a SPA

    Ben Dechrai
    Ben Dechrai
    Developer Evangelist
    Auth0
    schedule 4 years ago
    Sold Out!
    30 Mins
    Talk
    Beginner

    Single Page Apps are slick and fast. By moving much of the business logic to the browser, they gain advantages both for the application, as well as the load on hosting infrastructure.

    But if they're running in the browser, how do we secure them? The code is there for all to see. Cookies and local storage aren't 100% safe. And what if the user refreshes?!

    JSON Web Tokens provide a way to make sure that user credentials are kept safe, while still allowing browser-based apps to communicate with APIs.

    This talk will take you from knowing what JWTs are to understanding how to use them, and where to get started. We'll look at the request lifecycle of the authentication process, and cover best practices for JWT storage and handling.

  • Ben Dechrai
    keyboard_arrow_down

    Ben Dechrai - Zero Knowledge; you can't leak what you don't know

    Ben Dechrai
    Ben Dechrai
    Developer Evangelist
    Auth0
    schedule 4 years ago
    Sold Out!
    45 Mins
    Talk
    Intermediate

    We regularly hear of another data breach at another large company, or of governments collecting and storing more of our data. Even if we trust our service providers, they're creating a honey-pot of information that criminals would love to get their hands on.

    Data in transit is a mostly solved problem, with TLS securing the connections, but how about when the data is at rest? Encryption is hard, and worse, it's not end-user friendly. One misstep, and it's as good as useless.

    Learn the steps you can take to secure more of the data you store, and how you can evaluate the benefit or risk these different approaches will bring you and your customers.

  • Peter Lam
    keyboard_arrow_down

    Peter Lam / Penelope Barr - Agile, Scrum and other agile weapons to dishearten teams

    45 Mins
    Case Study
    Intermediate

    Come along and get involved in an interactive discussion about agile approaches, values and techniques and how they they can be MISUSED to dishearten teams. Hear warstories and how we earned certain scars as we took on the challenge to support teams and flip the pattern.

    Background:
    Many organisations are adopting and scaling agile / new ways of working. The sheer number of these changes happening at the same time, means that there aren't quite enough people with experience supporting and leading the journeys. This can mean there's a great opportunity for learning but the challenge of learning and then quickly translating theoretical information into on-the-ground knowledge to teach others, will result in obvious gaps. This creates three key problems

    1. Practices and approaches being implemented with the best of intent, but missing the important (hard bits) leading to disheartening teams
    2. Misunderstanding of the time any change takes to implement and that the pace is set by people's capacity to learn and adapt
    3. Extended time being taken to best assist teams because they set out to resolve the 'wrong' problem, using sub-optimal practices and approaches

    Come and join in the interactive discussion and presentation which will help set you up for success by

    • Identifying key antipatterns
    • Proven counter to untangle the pattern
  • Niall McShane
    keyboard_arrow_down

    Niall McShane - Creating and managing tensions in coaching

    90 Mins
    Workshop
    Intermediate

    As a coach there are natural tensions that come into play as you execute your role to affect the system of work, influence culture and change behaviours. The EGDE that good coaches are able to find allows them to navigate these tensions whilst maintaining the balance of stance in the moment that the situation requires.

    Think of seeing the "trees versus the forest" but on multiple levels/layers concurrently. Being an actor on the stage versus maintaining distance from the system of work (being in the audience).

    In this workshop I will take the audience through some of the tensions I've recently experienced and navigated as a coach and how I have assisted other coaches to learn this skill and how you can develop it yourself.

help