Open Source Summit + ELC Europe 2019

In the classic OAuth 2.0 flows, the authorization server and the resource server are behind the same firewall, giving full power and control about sharing capabilities to the Identity Provider (i.e. Facebook, Amazon, Google etc...).

Because of new regulations about data portability (GDPR in Europe and CCPA in California), now every user is able to ask a full export of its data to be stored anywhere, breaking Identity Provider monopoly and control. In that context, users can now own fully a copy of their data and share it to whom they want. To really decentralize data from permissions, make users in control and companies GDPR compliant, you need now to update OAuth2.0 dance into a stateless flow and tokenize the GDPR permission contract.

In this talk, Mehdi will explain how you can use open source technologies to automate GDPR requests for your users to export 3rd-party data in your system and tokenize your GDPR contract using ALIAS protocol (based on OAuth2.0)