Topic
A security pattern that replaces long-lived credentials with short-lived, claim-scoped tokens exchanged via OIDC trust between issuer and provider.
In a dev.to write-up, Jorge RN traces the chain from a workload's own identity to an ephemeral OCI session token, where the authorization decision reads claims such as repository, workflow and branch.
Reality
A release workflow signed provenance, reached sigstore, then took a 404 on a package its owner has published for months. The registry withholds existence on purpose, so the real fault, a runner bundling npm 10.8.2, never appears in the error.
Reality
Build configurations can now authenticate to AWS and Google Cloud without stored keys, provided you accept that the TeamCity server holds the signing key and that rotating it leaves already-issued tokens valid.
Reality
Workload Identity Federation swaps a downloadable JSON key for three objects that all have to exist before anything works. An InfoQ practitioner reports 120-plus GCP projects on it in six months, and names the gate teams leave open.
Reality
One practitioner's account of moving three Jenkins fleets onto AssumeRoleWithWebIdentity lists the same mistakes every time, and two of them leave the build lights green.
Reality