Blog
Articles, tutorials, and field notes on identity, integration, API management, and application security — spanning nearly two decades of hands-on work.
OAuth2 Access Tokens vs API Keys — Using JWTs
There are several approaches to securing APIs. Every API Gateway vendor supports the same core set of API security mechanisms. API Keys and OAuth2 are two examples of these authentication (plus authorization) mechanism. When should one be used over the other? What are the differences between the…
Identity Protocols, Hosted Login UIs, and Custom Login UIs
There are many ways to implement user authentication in a modern application (mobile, desktop, tablet, web, etc). I have previously explored Authentication, Federation, and SSO; that post introduces several key concepts that are assumed here. At the intersection of user experience, authentication,…
The Tale of Thomas, Richard, and Karen — A Software Architecture Parable
It so happened that one day, in a corporate IT department not unlike the one you are familiar with, three IT resources were preparing to design a software system. It doesn’t much matter what the system is or what it is supposed to do, for the results would be more-or-less the same. The assembled…
Differences Between Azure Active Directory and Red Hat SSO v7.1
I recently finished implementing OAuth2 and OIDC support for Azure Active Directory in my OAuth2 + OIDC Debugger. Previously, we implemented support for Red Hat SSO v7.1 and 3Scale. This post compares the two product’s implementations of these protocols (OAuth2 and OIDC). In particular, it looks at…
OAuth2 Resource Owner Password Credential Grant with 3Scale and Red Hat SSO
This blog post continues demonstrating (and documenting) the use of the OAuth2 + OIDC Debugger with 3Scale API Management and Red Hat SSO. Now, we are going to look at the OAuth2 Resource Owner Password Credential Grant with 3Scale and Red Hat SSO.
OAuth2 Implicit Grant with 3Scale and Red Hat SSO
This post demonstrates the OAuth2 Implicit Grant with 3Scale SaaS, APICast Gateway, and Red Hat SSO v7.1. In the last post, we introduced these components and demonstrated a functioning OAuth2 Authorization Code Grant (and OpenID Connect Authorization Code Flow). This is all part of my 3Scale API…
OAuth2 Configuration in 3Scale API Management (and APICast) with Red Hat SSO
This tutorial builds on the capabilities we explored in the “Red Hat SSO + 3Scale API Management” series and in particular in the first tutorial. In this post, we will:
Red Hat SSO v7.1 OAuth2 Client Credentials Grant
This post continues our exploration of OAuth2 Authorization Grants with Red Hat SSO v7.1. In previous posts, we looked at:
Red Hat SSO v7.1 OAuth2 Resource Owner Password Credential Grant Support
In this post, we will look at an example of the OAuth2 Resource Owner Password Credential Grant using Red Hat SSO v7.1. In previous posts, I described the Red Hat SSO setup for OpenID Connect authentication and OAuth2. We have also looked at examples of:
Red Hat SSO and 3Scale API Management Series
This post contains a collection of links to blog posts I’ve written about the use of OAuth2 and OpenID Connect with Red Hat SSO and 3Scale API Management.
OAuth2 Implicit Grant with Red Hat SSO v7.1
In my last post, we looked at how to configure Red Hat SSO v7.1 for OpenID Connect. That post also introduced a web-based OAuth2 + OIDC debugger and the OIDC Authorization Code Authentication Flow. The Red Hat SSO configuration that was created in that post also allows the OAuth2 Implicit Grant to…
Red Hat SSO v7.1 Spec Support
Red Hat SSO v7.1 provides support for OAuth2, OpenID Connect, and SAML2. There are numerous other identity protocols, but these are quite common and can handle a wide variety of use cases.