Topics

#openid-connect

Things I've written about #openid-connect

Identity & Security · 8 min read

IAM Chapter 5, Part 3: Who Logged In

OAuth got the app permission. It never said whose permission it was. OpenID Connect adds the ID token, the four checks that make it worth anything, published signing keys, and discovery: one string instead of four.

iam
oidc
openid-connect

Read post →Nov 02, 2026

Identity & Security · 9 min read

IAM Chapter 5, Part 4: Bound to This Login

The four checks prove the token is real. They never prove it is yours. Nonce vs state, claims in the token vs UserInfo, why there is never only one session, and what an OIDC migration from SAML really costs.

iam
oidc
openid-connect

Read post →Nov 02, 2026