https://www.shkcorp.com/blog Notes from a technical product leader on product management, identity & access management, and agentic AI — from 12 years of building enterprise software. en-us kshameed7@gmail.com (Hameed Syed K) kshameed7@gmail.com (Hameed Syed K) Mon, 02 Nov 2026 00:00:00 GMT https://www.shkcorp.com/blog/iam-chapter-5-part-3-oidc-who-logged-in https://www.shkcorp.com/blog/iam-chapter-5-part-3-oidc-who-logged-in OAuth got the app permission. It never said whose permission it was. OpenID Connect adds the ID token, the four checks that make it worth anything, published signing keys, and discovery: one string instead of four. Mon, 02 Nov 2026 00:00:00 GMT kshameed7@gmail.com (Hameed Syed K) iamoidcopenid-connectoauthjwtjwkssecuritystudy-notes https://www.shkcorp.com/blog/iam-chapter-5-part-4-oidc-bound-to-this-login https://www.shkcorp.com/blog/iam-chapter-5-part-4-oidc-bound-to-this-login The four checks prove the token is real. They never prove it is yours. Nonce vs state, claims in the token vs UserInfo, why there is never only one session, and what an OIDC migration from SAML really costs. Mon, 02 Nov 2026 00:00:00 GMT kshameed7@gmail.com (Hameed Syed K) iamoidcopenid-connectsamlsessionslogoutsecuritystudy-notes