>> Hey friends, did you know that verifiable credentials
in Azure Active Directory enables you to
prove that you are you on
the Internet while keeping
your credentials and your information private.
Engineer, Sydney Morton is going to tell me how
this works, today on Azure Friday.
[MUSIC]
Hey friends, I'm Scott Hanselman and it's
Azure Friday. Today I've got Software Engineer,
Sydney Morton here to tell me all about Azure
verifiable credentials as a service.
That's a thing I didn't know existed. That's pretty cool.
>> Yeah. It's super cool, super new.
We just got to public preview a couple weeks ago, actually. Yeah.
>> My understanding of Decentralized Identity
is limited and I see though that recently,
just as a user,
I'm having to enter my password a lot less.
I'm seeing a lot more QR codes,
and I'm seeing a lot more verification
of who I am by using my phone.
I get a notification on my phone and I
look at it and it uses biometrics,
whether it be my touch ID or my face ID or whatever and it's like,
oh, I guess you knew that it was me. That was cool.
>> Totally. The world is definitely moving to
passwordless because passwords are not great.
They're hard to remember and you have so many of them.
We're trying to create
a passwordless world based on open standards.
>> Then you brought me a bunch of demos to explain how
this public preview of verifiable credentials as a service works.
Because that's really what it's all about
is the demos and explaining
essentially how does this work and why is it secure?
Because my non-technical partner is like,
"I don't know what's going on.
When do I enter my password?
It doesn't feel intuitive."
You're going to make it intuitive.
>> Yeah. Our goal for this solution
was to create a secure but privacy-preserving solution,
but also it has to be super
convenient and transparent to the user.
Signing into things, that's not why you
actually are trying to go onto the Internet.
It's just a barrier to get to where you want to go.
We want to make it as convenient as possible,
but also super secure.
In our solution also,
the user, right now,
all of their passwords,
all of the information is owned by third parties so you sign in,
you're going through an IdP, an identity provider.
For us, we want to put the control
back into the user so the user controls their credentials,
they control their data,
and we just give it all back to the user.
>> That's a great point. The identity provider point
is a really interesting one.
I never realized until I was signing up for
some classes and I ended up using
another third-party identity provider and I was like,
wow, I hope that I always have access to
that third-party identity provider or I'm
going to lose access to all these other things that I use.
>> Exactly. They have complete control of your data plus you
don't really know exactly what claims they have about you.
We want to have a more transparent relationship with the user
so they know what claims they own and
it's completely transparent inside of their application.
>> Let's go ahead and share your screen and see the demo.
>> Awesome. This is a typical demo.
We're building an entire platform for
Decentralized Identity and verifiable credentials.
But we believe this workplace credential
is going to be a very common use case for technology.
Right here, we're in
the Woodgrove Employee portal
and we're signed in as Matthew Michael
and you can scan this QR code to
get their Woodgrove employee verifiable credential.
We use the authenticator app because that's where
all of passwordless is,
all of your signing-in information is so we
thought this is the perfect app to add verifiable credentials.
Type in your EmployeeID,
add credential and you can see now that you have
a verified Woodgrove employee credential
inside of your authenticator app.
>> Hang on. Let me ask you a question there
because as soon as I saw the QR code I was like,
I'm going to take a picture and I'm going to steal
Matthew Michael's identity and then
I saw you enter in an Employee ID,
I wouldn't have had that.
>> Exactly. Right now you can see on the screen you have
the Employee ID number just as the demo,
but that could be a text message or an e-mail that only you have.
That's a security measure we
have taken to prevent some attack like that.
>> Yeah. I just got into my Microsoft Authenticator app
and I'm stuck at this point.
Even though I was looking over your shoulder,
I was not able to steal that idea and break into the company.
>> Exactly. Something else
interesting about the verifiable credential is you can
actually see all of the claims
about you that is contained inside the verifiable credential.
You can see when it was issued on,
when it expires, and who was issued from.
It's super transparent and
then you can also see
recent activity so it was issued by Woodgrove,
we haven't really presented it
yet so very transparent to the user again.
Next I want to show how you can actually go to a third party,
something that some company that has
nothing to do with Woodgrove and you can
actually access a corporate discount
by presenting your Woodgrove employee card
because they might be partners.
>> I literally did this.
I'm getting them picking up a TV on Sunday.
It was a whole dance between
the logging into Microsoft and it
was dance between identity providers and so,
you're just literally showing me a scenario that I did days ago.
>> Yeah, it's super relevant.
I do this all the time too
and there's no federation that needs to go on.
Woodgrove doesn't have to know
about Proseware requesting their credential.
But Proseware will know as soon as
we send our credential over to them that Michael,
who is this person is a Woodgrove employee.
You can also see just in case you want to,
again, what claims are in the cards.
What information you're actually presenting to Proseware.
I can allow, and I can send this response and there we go.
Now you have a corporate discount count applied.
>> Help me understand this. Federation, I'm
familiar with where I'm at the Proseware site,
I say, "Hey, I'm a Microsoft employee," or whatever,
and I click a button, I hop over to one website,
I tell them that and then they go and say, "Yeah,
we're cool with that guy."
It's like the transitive property of friendship.
Like, me and Sydney are cool and Sydney and so and so are cool,
therefore, I'm cool with so and so and it's a whole dance.
But you didn't, you inserted
your card in the slot and you said, this is me.
>> Exactly. Proseware was requesting
verifiable credential issued by Woodgrove and they're able to
understand exactly what verifiable credential they wanted
based on a type and Woodgrove is not involved at all,
so they don't have to even worry about it.
>> Do they use SDK or what's inside?
There's some magic in the certificate.
>> Exactly. It's so interesting
because this is based on open standards.
The developer at Proseware could
actually implement all the crypto operations,
everything behind the scenes,
all the protocol, because it's based on OpenID Connect.
But we don't think that
a typical developer would want to deal with all of that stuff.
Again, we're trying to focus on the convenience
of the user and also the developer experience.
We actually created client API
that actually deals with all the crypto operations,
all of the protocol, and they only have to make
one API call in order to request verifiable credentials.
>> I personally set up OpenID and
OpenID Connect by reading the spec,
and we worked on this on our blogs to make it so people could
log into OpenID and it was not one line of code.
It was like a thing,
and that's why it never took off.
>> Yeah. Something we actually
learned in private preview actually,
had an SDK that did this and it was based in Node.
Something we got from our customers was that they really
wanted a client API, something super simple,
that where their back-end could be
any language they wanted and they just have to
make a call to the API and then we deal with everything else.
That was definitely a learning we learned during private preview.
But this is the API call.
You can choose to even include the QR code,
and it has all of the security properties and everything,
and this is the just requesting the credential.
You want to Woodgrove verified employee credential.
Say they eventually maybe want
a Microsoft verified employee credential,
they could just add it to this data object array
and you could request that as well.
Then returned is just this URL,
and this is actually based on OpenID Connect,
and this is actually
what is encoded in the QR code that you saw me scan.
It's very simple.
>> I exceeded it's words,
but it's not human-readable,
but that's the secret sauce.
That's the magic in there.
It's interesting that the URL is a protocol handler, right?
>> Yeah. You can actually use it to deep link
to the Authenticator app or just encode it in a QR code,
and cameras can pick it up and
know that they need to go to the Authenticator app.
>> I noticed that when I took the photograph on my iPhone,
it said automatically,
"I'll open this in Authenticator."
>> Yeah.
>> It's because Authenticator registered itself as
the protocol handler and the phone just said,
I'll just launch that URL.
HTTP goes to edge and OpenID [inaudible]
goes over to Authenticator.
>> The Authenticator app. Exactly. Yeah.
>> Very cool.
>> Yeah, it's super cool. That's how
you request and verify verifiable credentials as a relying party.
But there's one more missing piece and that
is issuance of verified credentials.
How does a Woodgrove admin actually create
a way to issue a Woodgrove verified employee credential.
We created this verifiable credentials as a service,
and this is the admin experience.
What I will do is I will actually show how easy
it is by creating a verifiable credential right there,
right now for you guys.
What we do is you type in your name.
That would be Woodgrove. Type in a domain.
This domain is used to provide
trust between the issuer of the credential and the user,
and then we select a Key Vault.
Something about our services is that we're completely stateless.
We don't deal with the Keys.
As Microsoft, we don't deal with the Keys.
Azure Key Vault is in the tenant of Woodgrove, of the issuer.
We also don't deal with any data.
We're completely stateless as an issuer in service.
Once we do this, we save and create
the credential and we create a verified employee credential,
and this is where all of the information comes.
It's right here. We have two files we
need to upload, the display file.
This shows the look and feel of
the credential inside of the Authenticator app.
>> People think about cards.
They want to feel like there's a card.
>> Exactly. Then we have the rules file.
This is the requirements needed in order to issue a credential.
>> How will I get these things? I know that I
can draw a picture of a card,
but how do I get these JSON files?
>> Right now, we're actually going to create
a form fill and we're going to have
an interactive wizard that actually shows you the card,
and that's coming pretty soon.
>> Cool.
>> Once we have uploaded both of these files,
we can go create.
It is literally as simple as that.
Now you're able to issue verified employee cards.
>> We're using the example of employees.
But correct me if I'm wrong,
it could be my Chipotle taco card.
>> Yes.
>> If I have an AD for my own home because I've
got Azure AD and I've set it up for the family here,
it could be to open a smart lock,
like credentials are whatever you choose them to be.
>> Exactly. We're building a platform for
verifiable credentials and
an ecosystem for decentralized identity.
Customers and relying parties
can really use this to create anything they want.
We're just making it easier for them to do that.
>> Cool. To make sure that we
understand that it's not just about employee cards, right?
>> Yes.
>> It's about the virtualization of all this physical crap that I
have in my wallet right here,
which has a bunch of physical cards that
I'm always carrying around. This is cool.
>> Yeah.
>> I see it says Beta inside of
the Microsoft Authenticator app which you're using right there.
>> Yes.
>> Folks can go learn about this.
We're going to put links in the show notes to learn all about
verifiable credentials that you'll find on
the Azure website underneath, Active Directory.
This is in public preview.
>> Yes.
>> People out there who have an Azure AD
and are using the Microsoft Authenticator app,
they can start playing with this right away.
>> Right away. Please, we
would love to see more people get more involved.
>> All right.
>> Get feedback.
>> I assume that there's feedback links in
the portal that go to actual real humans like you,
that can help them be successful.
>> Yeah, definitely.
>> Fantastic. I am learning all about
verifiable credentials as a service today on Azure Friday.
Hey, thanks for watching this episode of Azure Friday.
Now I need you to like it, comment on it,
tell your friends, retweet it,
watch more Azure Friday.
[MUSIC]