Heather Flanagan
- Editor contributions to the IDPro Body of Knowledge
- Standards work across IETF and the identity community
- Writing and education on federation and identity standards
Bio
Heather Flanagan works at the intersection of standards, writing, and the identity community. She has contributed to the IDPro Body of Knowledge and to standards efforts across the IETF and federation community, and is known for making complex identity standards legible to practitioners. Her consulting and writing focus on federation, governance, and the human side of standards.
Profile built from public IDPro, IETF, and personal-site records.
Where their work shows up
The IDPro Body of Knowledge is one of the few vendor-neutral attempts to define what an identity practitioner should actually know, which makes it a useful complement to our fundamentals guides and glossary. Her federation standards work touches SAML 2.0 and the trust frameworks that make cross-organization federation work.
Podcasts
Hosts A Digital Identity Digest.
- Designing Digital Wallets for Reality: Where Selective Disclosure and ZKPs Fit · A Digital Identity Digest · 2026-03-03
- Understanding the FIDO Alliance's Standards and Working Groups · A Digital Identity Digest · 2026-02-17
- Inside the OpenID DCP Working Group: Issuance, Presentation, and Reality · A Digital Identity Digest · 2026-01-27
- Delegation in a Multi-Actor World: It's Not Just OAuth Anymore · A Digital Identity Digest · 2025-06-27
Related on Start with Identity
- Blog1 of 123 AI agent identity drafts at the IETF has been adopted, and 7 of 11 agent problems already have a standard
SWI's Agent Identity Standards Map 2026 dates the status of 70 specifications for AI agent authentication, delegation and authorization. Most of the problem is
- PodcastA Digital Identity Digest
Short weekly episodes from standards veteran Heather Flanagan that "translate geek to human" on identity standards, wallets, and the web platform.
- BlogA loose PHP comparison let attackers sign in as WordPress admin through SAML
Two unauthenticated bypasses in the miniOrange SAML 2.0 Single Sign On plugin, CVE-2026-61979 and CVE-2026-15981, treat OpenSSL's error return as a valid signat
- CVEAD FS elevation of privilege exploited as a zero-day
A low-privileged local user on an AD FS server could become administrator on the box that holds the federation token-signing keys. Microsoft saw exploitation be
- BlogAgent identity just got a protocol, which is the easy half
Okta shipped Agent SSO and got Cross App Access adopted into MCP the same month a GitHub issue was shown to reach CI secrets in Claude Code and Gemini CLI. The
- PodcastAuth0
The late Vittorio Bertocci's interviews with the authors of OAuth, OpenID Connect, FIDO, and SAML. Ended in 2022, and still the best audio archive on identity s