https://www.shkcorp.com/blog Notes from a technical product leader on product management, identity & access management, and agentic AI — from 12 years of building enterprise software. en-us kshameed7@gmail.com (Hameed Syed K) kshameed7@gmail.com (Hameed Syed K) Mon, 02 Nov 2026 00:00:00 GMT https://www.shkcorp.com/blog/iam-chapter-5-part-4-oidc-bound-to-this-login https://www.shkcorp.com/blog/iam-chapter-5-part-4-oidc-bound-to-this-login The four checks prove the token is real. They never prove it is yours. Nonce vs state, claims in the token vs UserInfo, why there is never only one session, and what an OIDC migration from SAML really costs. Mon, 02 Nov 2026 00:00:00 GMT kshameed7@gmail.com (Hameed Syed K) iamoidcopenid-connectsamlsessionslogoutsecuritystudy-notes