https://www.shkcorp.com/blog Notes from a technical product leader on product management, identity & access management, and agentic AI — from 12 years of building enterprise software. en-us kshameed7@gmail.com (Hameed Syed K) kshameed7@gmail.com (Hameed Syed K) Mon, 02 Nov 2026 00:00:00 GMT https://www.shkcorp.com/blog/iam-chapter-5-part-3-oidc-who-logged-in https://www.shkcorp.com/blog/iam-chapter-5-part-3-oidc-who-logged-in OAuth got the app permission. It never said whose permission it was. OpenID Connect adds the ID token, the four checks that make it worth anything, published signing keys, and discovery: one string instead of four. Mon, 02 Nov 2026 00:00:00 GMT kshameed7@gmail.com (Hameed Syed K) iamoidcopenid-connectoauthjwtjwkssecuritystudy-notes