Questions tagged [secevents]

Questions related to SecEvents WG in IETF and RISC at the OpenID Foundation

Filter by
Sorted by
Tagged with
0 votes
0 answers
18 views

Unable to receive to verify the stream configuration for Google cross account protection (RISC)

I've had my event endpoint setup and also configured the event stream. However, when testing my stream configuration, I got 200 for sending authorized HTTPS POST request to https://risc.googleapis.com/...
Guanda Li's user avatar
0 votes
0 answers
87 views

Google Cross-Account Protection (RISC) API testing

I am following the documentation here: https://developers.google.com/identity/protocols/risc#overview My setup is working, when I hit the /stream:verify endpoint I can see logs in my REST API endpoint....
PiaklA's user avatar
  • 495
0 votes
0 answers
43 views

403, The caller does not have permission, when try to get a test token

I try use get a test token following this instruction https://developers.google.com/identity/protocols/risc#java_3, and I get ` "code": 403, "message": "The caller ...
user20731200's user avatar
0 votes
1 answer
120 views

How to differentiate streams in Google Cross-Account-Protection (RISC)

The documentation says the jti identifies the event and "is unique to the stream". That means it could be repeated in multiple streams. What differentiates the stream? And how can I make ...
Felipe Müller's user avatar
2 votes
0 answers
84 views

Registering a RISC receiver endpoint for Google fails with 403 Forbidden "The caller does not have permission"

I'm trying to register an API endpoint to receive RISC security events from Google and have followed their tutorial for doing this. However, I've been struggling to get a successful response from ...
moazelshebly's user avatar
0 votes
0 answers
172 views

Google Cross-Account Protection (RISC) API. Callback endpoint registration returns 500 Internal Server Error

I am trying to register an api callback endpoint in google Cross-Account Protection, but I keep getting a 500 Internal Server Error response with the following body: { "error": { "...
hiddenSt's user avatar
0 votes
1 answer
181 views

403 Forbidden when trying to register receiver endpoint using the RISC API

While trying to register my receiver endpoint in order to start receiving RISC indications from google, I constantly get the same reply: 403 Client Error: Forbidden for url: https://risc.googleapis....
Weknin's user avatar
  • 101
0 votes
1 answer
399 views

stream:verify is failing with "The caller does not have permission" error

My security event receiver is set up and I'm at this step trying to test that it actually works. I've copied the code from the example almost exactly, but my script is resulting in an error. Here's ...
Steve Hoffing's user avatar
1 vote
1 answer
183 views

Why am I not receiving Google security events for G Suite accounts?

I have successfully implemented Google Sign-In for my application as described here, with an additional layer of validation using our back-end server as described here. However, when I try to register ...
wpercy's user avatar
  • 9,774
2 votes
1 answer
147 views

Google-RISC security event is not getting fired for my G-suite email

I have implemented google oauth login and google RISC security event handling for our app. To enable oauth, I have created web app on google console using our G suite email address. After enabling ...
Abhilasha's user avatar
  • 1,197
1 vote
1 answer
181 views

What is the payload for the Google-RISC API callback?

I am currently integrating with the Google Cross Account Protection (RISC). As per the docs, there must be some sort of security token that will be posted to the endpoint that you registered. The ...
Inon Baguio's user avatar
2 votes
1 answer
133 views

Does anyone support RISC or SecEvents specs?

I've been reading about the SecEvents WG in IETF (https://datatracker.ietf.org/wg/secevent/about/) and RISC at the OpenID Foundation (https://openid.net/wg/risc/). These look like interesting ways to ...
Adam Dawes's user avatar