Tag: #oidc

← All posts

• The Complete Guide to Authentication and Authorization: Ten Misconceptions, Corrected From the Specs ♪ Listenable

  OAuth 2.0 is an authorization framework; OIDC is the authentication layer on top of it. This guide corrects the flows that fell out of the recommendations, the illusion of JWT validation, and the real trade-offs of token

  2026-08-15 · 25 min read #인증#인가#oauth#oidc#jwt

• Building SSO with Keycloak — From Realm, Client, and Flows to the 2026 New Features

  Instead of bolting a separate login onto each of 20 internal apps, SSO lets a single identity server stand in for all of them. This post makes sense of Keycloak — the open-source standard — through four core concepts (Re

  2026-07-09 · 9 min read #keycloak#sso#oidc#security#devops

• From SiteMinder to Keycloak — A Legacy SSO Migration Strategy and Practical Roadmap

  A practical roadmap for migrating a SiteMinder estate to Keycloak: application inventory classification, an object mapping table, SAML brokering coexistence architecture, oauth2-proxy header translation, gradual password

  2026-06-12 · 16 min read #keycloak#siteminder#sso#iam#migration

• OpenID Connect Deep Dive — From the Authorization Code Flow to Discovery

  A protocol-level dissection of how OIDC stacks an authentication layer on top of OAuth 2.0: the role differences between ID Token, Access Token, and Refresh Token, and the detailed Authorization Code + PKCE flow with rea

  2026-06-12 · 14 min read #oidc#oauth2#jwt#sso#security

• Customizing Keycloak Tokens — Protocol Mappers and Claims Design in Practice

  A hands-on guide to designing JWT claims with Keycloak Protocol Mappers and Client Scopes. Covers built-in mappers, a custom ProtocolMapper SPI implementation, audience validation pitfalls, token bloat diet strategies, a

  2026-06-12 · 15 min read #keycloak#oidc#jwt#sso#security

• Keycloak 26 Architecture Deep Dive — Understanding Realms, Clients, and the Quarkus Runtime

  A deep dive into the internal architecture of Keycloak 26.x. We cover the WildFly-to-Quarkus transition, the realm/client/role domain model, the authentication flow engine, kc.sh build optimization, and the new features

  2026-06-12 · 16 min read #keycloak#sso#oidc#security#devops

• FAPI 2.0 — A Complete Guide to the Financial-grade API Security Profile

  A thorough walkthrough of FAPI 2.0 Security Profile, the standard of the open banking and open data era. Covers the simplification from FAPI 1.0 to 2.0, the core requirements of PAR, PKCE, and sender-constrained tokens,

  2026-06-12 · 15 min read #fapi#oauth2#oidc#keycloak#security

• The Hard Problem of Single Logout (SLO) — Designing Front-Channel and Back-Channel Logout

  In SSO, logout is harder than login. This post covers the three-layer session model, how OIDC RP-Initiated/Front-Channel/Back-Channel Logout work and where they fail, the logout token JWT structure, the realistic failure

  2026-06-12 · 17 min read #sso#oidc#saml#keycloak#logout

• SSO Fundamentals — SAML vs OAuth 2.0 vs OIDC, What to Use and When

  A complete walkthrough of how SSO works (IdP/SP/RP), sessions vs tokens, and the history and role differences of SAML, OAuth 2.0, and OIDC. Includes a protocol decision tree, comparison tables, and real authentication fl

  2026-06-12 · 18 min read #sso#saml#oauth2#oidc#iam

• OAuth 2.1 Migration Guide — Designing Authentication in the Era of Mandatory PKCE

  A deep dive into the known weaknesses of OAuth 2.0 and how the OAuth 2.1 draft consolidates RFC 6749, RFC 7636, and RFC 9700 into a single spec. We cover why Implicit and ROPC were removed, how PKCE works, refresh token

  2026-06-12 · 17 min read #oauth2#oidc#security#pkce#sso

• Designing the Coexistence of Legacy WebSSO and Modern IAM — Architecture Patterns for the Hybrid Transition Era

  The transition from legacy WebSSO to modern IAM lasts for years. We organize four coexistence patterns — protocol bridges, reverse-proxy header injection, identity orchestration, and the strangler fig — along with sessio

  2026-06-12 · 18 min read #iam#sso#keycloak#siteminder#architecture

• Keycloak Identity Brokering — From Social Login to External IdP Federation

  A practical guide to building Google/GitHub/Apple social login and external SAML/OIDC IdP federation with Keycloak Identity Brokering. Covers the first broker login flow, account linking with duplicate emails, attribute

  2026-06-12 · 15 min read #keycloak#sso#oidc#saml#identity-brokering

• OAuth Token Exchange (RFC 8693) — The Definitive Guide to Delegation and Propagation in Microservices

  How to solve the token propagation problem between microservices with RFC 8693 Token Exchange. Covers the difference between impersonation and delegation, request and response parameters, standard support in Keycloak 26.

  2026-06-12 · 15 min read #oauth2#keycloak#oidc#security#microservices

• Designing SSO for Multi-Tenant SaaS — An Architecture for Enterprise Customer Onboarding

  In B2B SaaS, supporting SSO means federating with each customer IdP. This post designs multi-tenant SSO end to end: realm-per-tenant vs Keycloak Organizations, email-domain home realm discovery, domain verification, JIT

  2026-06-12 · 16 min read #sso#saas#keycloak#oidc#saml

• Keycloak + Spring Security 6 Integration — Resource Server and OAuth2 Client in Practice

  A practical guide to integrating Keycloak with Spring Security 6 as an OAuth2 Resource Server and Client. Covers issuer-uri auto-configuration, mapping realm and client roles with JwtAuthenticationConverter, OIDC logout,

  2026-06-12 · 11 min read #keycloak#spring-security#oauth2#oidc#jwt

• OIDC Token Validation at the API Gateway — Istio, Envoy, and Gateway API in Practice

  Validate at the edge or in the service? This post covers detailed Envoy jwtauthn filter configuration, the Istio RequestAuthentication plus AuthorizationPolicy combination, JWKS caching and failure modes, audience strate

  2026-06-12 · 15 min read #istio#envoy#jwt#oidc#api-gateway

• Advanced OAuth Flows — When You Need CIBA, Device Flow, and DPoP

  A guide to advanced OAuth mechanisms for authentication scenarios that the standard redirect flow cannot solve. Covers the Device Authorization Grant (RFC 8628), CIBA with its poll/ping/push modes, the DPoP (RFC 9449) pr

  2026-06-12 · 15 min read #oauth2#oidc#keycloak#ciba#dpop

• Mastering JWT Security — Signature Verification, Key Rotation, and Common Vulnerabilities

  We dissect the structure of JWT, JWS, and JWE and cover real-world vulnerabilities such as alg confusion attacks and kid injection, along with their defenses. From JWKS-based key rotation and algorithm selection includin

  2026-06-12 · 16 min read #jwt#security#oidc#keycloak#cryptography

• Where Developer Tokens Leak — The VSCode 1-Click Token Theft and Secret Hygiene

  Dissecting the June 2026 case of one-click GitHub token theft through a VSCode bug, this post traces the paths along which tokens leak in developer environments. It covers PAT permission design, token rotation, secret sc

  2026-06-12 · 15 min read #security#github#tokens#devops#secrets

• SSO and Identity Providers in 2026 - A Deep Dive into Keycloak 26, Authentik, Authelia, Auth0, Okta, AWS Cognito, and Microsoft Entra ID ♪ Listenable

  A full survey of the SSO and Identity Provider landscape in 2026. Standards (OAuth 2.1, OIDC, SAML, SCIM, WebAuthn), open-source IdPs (Keycloak 26, Authentik, Authelia, Casdoor), managed SaaS (Auth0, Okta, AWS Cognito, M

  2026-05-16 · 24 min read #sso#iam#keycloak#authentik#authelia