Tag: #oauth2
Writing on GPUs, LLMs, MLOps, Kubernetes — and mindset · 25 posts
Open Banking and MyData API Architecture — The Technology of Financial Data Openness
The API architecture of Korean open banking shared network and MyData (personal credit information management). We cover standard API specs and auth tokens, comparison with UK Open Banking and the FAPI security profile,
2026-06-13 · 16 min read #finance#open-banking#mydata#api#oauth2OpenID Connect Deep Dive — From the Authorization Code Flow to Discovery
A protocol-level dissection of how OIDC stacks an authentication layer on top of OAuth 2.0: the role differences between ID Token, Access Token, and Refresh Token, and the detailed Authorization Code + PKCE flow with rea
2026-06-12 · 14 min read #oidc#oauth2#jwt#sso#securityFAPI 2.0 — A Complete Guide to the Financial-grade API Security Profile
A thorough walkthrough of FAPI 2.0 Security Profile, the standard of the open banking and open data era. Covers the simplification from FAPI 1.0 to 2.0, the core requirements of PAR, PKCE, and sender-constrained tokens,
2026-06-12 · 15 min read #fapi#oauth2#oidc#keycloak#securityRefresh Token Rotation and Session Management — Designing a Theft-Resistant Token Lifecycle
From access/refresh token lifetime design principles to rotation, reuse detection, and token family invalidation — we design a token lifecycle that assumes theft. We cover the three-layer model of IdP, app, and SSO sessi
2026-06-12 · 16 min read #oauth2#session#keycloak#security#ssoSSO Fundamentals — SAML vs OAuth 2.0 vs OIDC, What to Use and When
A complete walkthrough of how SSO works (IdP/SP/RP), sessions vs tokens, and the history and role differences of SAML, OAuth 2.0, and OIDC. Includes a protocol decision tree, comparison tables, and real authentication fl
2026-06-12 · 18 min read #sso#saml#oauth2#oidc#iamOAuth 2.1 Migration Guide — Designing Authentication in the Era of Mandatory PKCE
A deep dive into the known weaknesses of OAuth 2.0 and how the OAuth 2.1 draft consolidates RFC 6749, RFC 7636, and RFC 9700 into a single spec. We cover why Implicit and ROPC were removed, how PKCE works, refresh token
2026-06-12 · 17 min read #oauth2#oidc#security#pkce#ssoOAuth Token Exchange (RFC 8693) — The Definitive Guide to Delegation and Propagation in Microservices
How to solve the token propagation problem between microservices with RFC 8693 Token Exchange. Covers the difference between impersonation and delegation, request and response parameters, standard support in Keycloak 26.
2026-06-12 · 15 min read #oauth2#keycloak#oidc#security#microservicesKeycloak + Spring Security 6 Integration — Resource Server and OAuth2 Client in Practice
A practical guide to integrating Keycloak with Spring Security 6 as an OAuth2 Resource Server and Client. Covers issuer-uri auto-configuration, mapping realm and client roles with JwtAuthenticationConverter, OIDC logout,
2026-06-12 · 11 min read #keycloak#spring-security#oauth2#oidc#jwtAdvanced OAuth Flows — When You Need CIBA, Device Flow, and DPoP
A guide to advanced OAuth mechanisms for authentication scenarios that the standard redirect flow cannot solve. Covers the Device Authorization Grant (RFC 8628), CIBA with its poll/ping/push modes, the DPoP (RFC 9449) pr
2026-06-12 · 15 min read #oauth2#oidc#keycloak#ciba#dpopKeycloak Authorization Services — Fine-Grained Access Control with UMA 2.0
A deep dive into Keycloak Authorization Services that goes beyond the limits of RBAC. Covers the resource/scope/policy/permission model, the UMA 2.0 grant flow, policy enforcer configuration, decision strategies, and how
2026-06-12 · 16 min read #keycloak#authorization#uma#oauth2#security2026 IAM Trends — AI Agent Identity, MCP Authentication, Verifiable Credentials
The 2026 IAM landscape is being reshaped by passwordless-by-default, an explosion of non-human identities in the form of AI agents, and the OAuth 2.1-based standardization of MCP authorization. From on-behalf-of delegati
2026-06-12 · 16 min read #iam#oauth2#mcp#ai-agent#keycloakBuilding MCP Servers in Practice — How to Connect Your Tools to Every AI Agent
A hands-on guide to building MCP (Model Context Protocol) servers, the de facto standard of 2026. We implement an internal wiki search server in TypeScript and Python, and cover tool design principles, OAuth 2.1 authenti
2026-06-12 · 17 min read #mcp#ai-agent#typescript#python#oauth2SSO and Identity Providers in 2026 - A Deep Dive into Keycloak 26, Authentik, Authelia, Auth0, Okta, AWS Cognito, and Microsoft Entra ID
A full survey of the SSO and Identity Provider landscape in 2026. Standards (OAuth 2.1, OIDC, SAML, SCIM, WebAuthn), open-source IdPs (Keycloak 26, Authentik, Authelia, Casdoor), managed SaaS (Auth0, Okta, AWS Cognito, M
2026-05-16 · 24 min read #sso#iam#keycloak#authentik#autheliaKeycloak vs Authentik vs Zitadel vs Ory Hydra vs Auth0 vs WorkOS vs Okta — 2026 SSO / OIDC / SAML / OAuth 2.1 / FAPI 2.0 / FedCM Deep Dive
In 2026, OAuth 2.1 became an RFC, FAPI 2.0 went final and reached financial-services production, and Chrome and Edge shipped FedCM by default. Passkeys are no longer novel. This piece compares Keycloak 25, Authentik, Zit
2026-05-16 · 21 min read #keycloak#authentik#zitadel#ory-hydra#auth0API & Web App Auth Libraries 2026 Deep Dive — Auth.js v5 · Lucia v3 · better-auth · Clerk · Stytch · WorkOS · Kinde · SuperTokens · Frontegg
In 2026 the build-vs-buy line for web app auth is sharper than ever. From libraries like Auth.js v5, Lucia v3, and better-auth to managed SaaS like Clerk, Stytch, WorkOS, Kinde, SuperTokens, and Frontegg — this deep dive
2026-05-16 · 24 min read #english#auth-libraries#auth-js#lucia#better-authKeycloak Integration Hands-On — Run It with Docker, Configure Realm/Client, Wire Up Spring Boot and Next.js (2025 Hands-On Guide)
Don't build authentication yourself — use Keycloak. This is a follow-along hands-on: run Keycloak 26 with Docker, configure Realm/Client/User/Role, poke the OIDC endpoints with curl, and integrate a Spring Boot Resource
2026-05-14 · 23 min read #keycloak#oidc#oauth2#authentication#authorizationFrontend Security 2025 — XSS, CSRF, CSP, Trusted Types, JWT, OAuth, PKCE, Passkeys, Supply Chain, SRI (S6 E9)
XSS still tops every CVE report. But 2024–2025 shipped real tools to defeat it: Trusted Types, CSP v3 with strict-dynamic, Sanitizer API. Passkeys replaced passwords for serious products. Supply-chain attacks made SRI +
2026-04-15 · 6 min read #frontend#security#xss#csrf#cspOAuth 2.0 & OIDC Deep Dive — Authorization Code, PKCE, JWT, DPoP, FAPI (2025)
OAuth 2.0 and OIDC run billions of times daily, yet most developers understand them only superficially. This guide dissects them from scratch: the four OAuth 2.0 flows, why PKCE became mandatory, JWT structure and pitfal
2026-04-15 · 13 min read #oauth2#oidc#openid-connect#authentication#authorizationOAuth 2.0 & Authentication Complete Guide 2025: JWT, Sessions, SSO, OIDC, Passkey
Everything about web authentication! OAuth 2.0 flows (Authorization Code/PKCE/Client Credentials), JWT (structure/verification/Refresh Token), Session vs Token, SSO (SAML/OIDC), Passkey (WebAuthn/FIDO2), Social Login, Se
2026-03-25 · 22 min read #oauth2#authentication#jwt#session#ssoOAuth2 & JWT Complete Guide: Everything About Authentication and Authorization for Developers
Everything about OAuth2 and JWT with practical code! Authorization Code/PKCE/Client Credentials flows, JWT structure and signature verification, Access/Refresh Token strategies, Session vs Token comparison, OIDC, securit
2026-03-23 · 23 min read #oauth2#jwt#authentication#authorization#security