Tag: #oidc
Writing on GPUs, LLMs, MLOps, Kubernetes — and mindset · 29 posts
The Complete Guide to Authentication and Authorization: Ten Misconceptions, Corrected From the Specs
OAuth 2.0 is an authorization framework; OIDC is the authentication layer on top of it. This guide corrects the flows that fell out of the recommendations, the illusion of JWT validation, and the real trade-offs of token
2026-08-15 · 25 min read #인증#인가#oauth#oidc#jwtBuilding SSO with Keycloak — From Realm, Client, and Flows to the 2026 New Features
Instead of bolting a separate login onto each of 20 internal apps, SSO lets a single identity server stand in for all of them. This post makes sense of Keycloak — the open-source standard — through four core concepts (Re
2026-07-09 · 9 min read #keycloak#sso#oidc#security#devopsFrom SiteMinder to Keycloak — A Legacy SSO Migration Strategy and Practical Roadmap
A practical roadmap for migrating a SiteMinder estate to Keycloak: application inventory classification, an object mapping table, SAML brokering coexistence architecture, oauth2-proxy header translation, gradual password
2026-06-12 · 16 min read #keycloak#siteminder#sso#iam#migrationOpenID Connect Deep Dive — From the Authorization Code Flow to Discovery
A protocol-level dissection of how OIDC stacks an authentication layer on top of OAuth 2.0: the role differences between ID Token, Access Token, and Refresh Token, and the detailed Authorization Code + PKCE flow with rea
2026-06-12 · 14 min read #oidc#oauth2#jwt#sso#securityCustomizing Keycloak Tokens — Protocol Mappers and Claims Design in Practice
A hands-on guide to designing JWT claims with Keycloak Protocol Mappers and Client Scopes. Covers built-in mappers, a custom ProtocolMapper SPI implementation, audience validation pitfalls, token bloat diet strategies, a
2026-06-12 · 15 min read #keycloak#oidc#jwt#sso#securityKeycloak 26 Architecture Deep Dive — Understanding Realms, Clients, and the Quarkus Runtime
A deep dive into the internal architecture of Keycloak 26.x. We cover the WildFly-to-Quarkus transition, the realm/client/role domain model, the authentication flow engine, kc.sh build optimization, and the new features
2026-06-12 · 16 min read #keycloak#sso#oidc#security#devopsFAPI 2.0 — A Complete Guide to the Financial-grade API Security Profile
A thorough walkthrough of FAPI 2.0 Security Profile, the standard of the open banking and open data era. Covers the simplification from FAPI 1.0 to 2.0, the core requirements of PAR, PKCE, and sender-constrained tokens,
2026-06-12 · 15 min read #fapi#oauth2#oidc#keycloak#securityThe Hard Problem of Single Logout (SLO) — Designing Front-Channel and Back-Channel Logout
In SSO, logout is harder than login. This post covers the three-layer session model, how OIDC RP-Initiated/Front-Channel/Back-Channel Logout work and where they fail, the logout token JWT structure, the realistic failure
2026-06-12 · 17 min read #sso#oidc#saml#keycloak#logoutSSO Fundamentals — SAML vs OAuth 2.0 vs OIDC, What to Use and When
A complete walkthrough of how SSO works (IdP/SP/RP), sessions vs tokens, and the history and role differences of SAML, OAuth 2.0, and OIDC. Includes a protocol decision tree, comparison tables, and real authentication fl
2026-06-12 · 18 min read #sso#saml#oauth2#oidc#iamOAuth 2.1 Migration Guide — Designing Authentication in the Era of Mandatory PKCE
A deep dive into the known weaknesses of OAuth 2.0 and how the OAuth 2.1 draft consolidates RFC 6749, RFC 7636, and RFC 9700 into a single spec. We cover why Implicit and ROPC were removed, how PKCE works, refresh token
2026-06-12 · 17 min read #oauth2#oidc#security#pkce#ssoDesigning the Coexistence of Legacy WebSSO and Modern IAM — Architecture Patterns for the Hybrid Transition Era
The transition from legacy WebSSO to modern IAM lasts for years. We organize four coexistence patterns — protocol bridges, reverse-proxy header injection, identity orchestration, and the strangler fig — along with sessio
2026-06-12 · 18 min read #iam#sso#keycloak#siteminder#architectureKeycloak Identity Brokering — From Social Login to External IdP Federation
A practical guide to building Google/GitHub/Apple social login and external SAML/OIDC IdP federation with Keycloak Identity Brokering. Covers the first broker login flow, account linking with duplicate emails, attribute
2026-06-12 · 15 min read #keycloak#sso#oidc#saml#identity-brokeringOAuth Token Exchange (RFC 8693) — The Definitive Guide to Delegation and Propagation in Microservices
How to solve the token propagation problem between microservices with RFC 8693 Token Exchange. Covers the difference between impersonation and delegation, request and response parameters, standard support in Keycloak 26.
2026-06-12 · 15 min read #oauth2#keycloak#oidc#security#microservicesDesigning SSO for Multi-Tenant SaaS — An Architecture for Enterprise Customer Onboarding
In B2B SaaS, supporting SSO means federating with each customer IdP. This post designs multi-tenant SSO end to end: realm-per-tenant vs Keycloak Organizations, email-domain home realm discovery, domain verification, JIT
2026-06-12 · 16 min read #sso#saas#keycloak#oidc#samlKeycloak + Spring Security 6 Integration — Resource Server and OAuth2 Client in Practice
A practical guide to integrating Keycloak with Spring Security 6 as an OAuth2 Resource Server and Client. Covers issuer-uri auto-configuration, mapping realm and client roles with JwtAuthenticationConverter, OIDC logout,
2026-06-12 · 11 min read #keycloak#spring-security#oauth2#oidc#jwtOIDC Token Validation at the API Gateway — Istio, Envoy, and Gateway API in Practice
Validate at the edge or in the service? This post covers detailed Envoy jwtauthn filter configuration, the Istio RequestAuthentication plus AuthorizationPolicy combination, JWKS caching and failure modes, audience strate
2026-06-12 · 15 min read #istio#envoy#jwt#oidc#api-gatewayAdvanced OAuth Flows — When You Need CIBA, Device Flow, and DPoP
A guide to advanced OAuth mechanisms for authentication scenarios that the standard redirect flow cannot solve. Covers the Device Authorization Grant (RFC 8628), CIBA with its poll/ping/push modes, the DPoP (RFC 9449) pr
2026-06-12 · 15 min read #oauth2#oidc#keycloak#ciba#dpopMastering JWT Security — Signature Verification, Key Rotation, and Common Vulnerabilities
We dissect the structure of JWT, JWS, and JWE and cover real-world vulnerabilities such as alg confusion attacks and kid injection, along with their defenses. From JWKS-based key rotation and algorithm selection includin
2026-06-12 · 16 min read #jwt#security#oidc#keycloak#cryptographyWhere Developer Tokens Leak — The VSCode 1-Click Token Theft and Secret Hygiene
Dissecting the June 2026 case of one-click GitHub token theft through a VSCode bug, this post traces the paths along which tokens leak in developer environments. It covers PAT permission design, token rotation, secret sc
2026-06-12 · 15 min read #security#github#tokens#devops#secretsSSO and Identity Providers in 2026 - A Deep Dive into Keycloak 26, Authentik, Authelia, Auth0, Okta, AWS Cognito, and Microsoft Entra ID
A full survey of the SSO and Identity Provider landscape in 2026. Standards (OAuth 2.1, OIDC, SAML, SCIM, WebAuthn), open-source IdPs (Keycloak 26, Authentik, Authelia, Casdoor), managed SaaS (Auth0, Okta, AWS Cognito, M
2026-05-16 · 24 min read #sso#iam#keycloak#authentik#authelia