29 articles tagged OpenID Connect.
For all the excitement around Verifiable Credentials, there is a rather mundane problem hiding underneath the cryptography:
Read article: OID4VCI: OAuth2 Comes to the Credential Issuance ProblemDelegation is a concept that has always fascinated me in the identity space. It enables secure identity propagation with tokens (assertions, tickets, etc) being properly scoped. As functionality in my Identity Protocol Debugger has continued to evolve, I wanted to add a feature that would make it…
Read article: OAuth2 + OIDC + Delegation: An exampleCurrent as of August, 2026.
Read article: OAuth2 + OIDC: All of the Specs (2026 Edition)Or: How the Identity Industry Invented a Cryptographically Signed Phone Book
Read article: OpenID Federation Spec: Because Exchanging Metadata Spreadsheets Was Apparently Not a Great…Identity engineers have a complicated relationship with SAML.
Read article: The OAuth2/OIDC Debugger Has Learned a New Trick: SAML2 Support Is HereIf you’ve spent any amount of time integrating OAuth 2.0 or OpenID Connect (OIDC), you’ve probably experienced the same cycle:
Read article: Introducing IDPTools: An Open Source OAuth2 & OpenID Connect DebuggerThis post continues where “SECURELY USING THE OIDC AUTHORIZATION CODE FLOW AND A PUBLIC CLIENT WITH SINGLE PAGE APPLICATIONS” left off on the topic of securing Single Page Applications (SPAs). That post describes an architecture where the SPA running in the browser (User Agent)is acting as the…
Read article: More Single Page Application (SPA) and OAuth2 ThoughtsThis blog post was originally published as “SECURELY USING THE OIDC AUTHORIZATION CODE FLOW AND A PUBLIC CLIENT WITH SINGLE PAGE APPLICATIONS” on the Ping Identity blog.
Read article: SECURELY USING THE OIDC AUTHORIZATION CODE FLOW AND A PUBLIC CLIENT WITH SINGLE PAGE APPLICATIONSEarlier this year, I was working on a project that was using AWS Cognito (as the identity stack) and the AWS API Gateway (as the front-door to all of the API calls). AWS Cognito is a relatively new player in the identity space. It doesn’t support the full OAuth2 or OpenID Connect specs, but, does…
Read article: OpenID Connect Authorization Code Flow with AWS CognitoIt’s 2018. At this point, application developers should not be writing code that directly implements HTTPS calls to OAuth2 or OpenID Connect endpoints, token caching, token refreshes, token validation, or other such activities. An authentication library should be used that implements these…
Read article: OpenID Connect (OIDC) and OAuth2 Authentication Libraries
