Blog
Articles, tutorials, and field notes on identity, integration, API management, and application security — spanning nearly two decades of hands-on work.
Red Hat SSO v7.1 OAuth2 Client Credentials Grant
This post continues our exploration of OAuth2 Authorization Grants with Red Hat SSO v7.1. In previous posts, we looked at:
Red Hat SSO v7.1 OAuth2 Resource Owner Password Credential Grant Support
In this post, we will look at an example of the OAuth2 Resource Owner Password Credential Grant using Red Hat SSO v7.1. In previous posts, I described the Red Hat SSO setup for OpenID Connect authentication and OAuth2. We have also looked at examples of:
Red Hat SSO and 3Scale API Management Series
This post contains a collection of links to blog posts I’ve written about the use of OAuth2 and OpenID Connect with Red Hat SSO and 3Scale API Management.
OAuth2 Implicit Grant with Red Hat SSO v7.1
In my last post, we looked at how to configure Red Hat SSO v7.1 for OpenID Connect. That post also introduced a web-based OAuth2 + OIDC debugger and the OIDC Authorization Code Authentication Flow. The Red Hat SSO configuration that was created in that post also allows the OAuth2 Implicit Grant to…
Red Hat SSO v7.1 Spec Support
Red Hat SSO v7.1 provides support for OAuth2, OpenID Connect, and SAML2. There are numerous other identity protocols, but these are quite common and can handle a wide variety of use cases.
What is Authorization?
In a previous post, I gave a definition of Authentication. In this post, we’re going to explore authorization, which is typically the next step in the processing pipeline after authentication. The concepts described here can apply equally to traditional web applications, SPA apps, mobile apps,…
OpenID Connect (Authorization Code Flow) with Red Hat SSO
This post was originally published as “White Paper: OpenID Connect (Authorization Code Flow) with Red Hat SSO” on the Levvel Blog.
Application Security Models
I like to start system design (at the application level) with the security model that will be used to protect the system. Application security models have several attributes that need to be addressed at each layer of the application.
Digital Signature Series
The following blog posts are part of a series I wrote on digital signatures.
Performance Tuning Methodology
I’m taking a brief excursion from my usual identity and API-centric posts to answer a question about performance tuning that someone asked me earlier this year. In a previous incarnation of my career, I was focused on performance tuning and diagnostics — particularly involving Java systems.…
Understanding WS-Federation — Passive Requestor Profile
There are several identity protocols that are commonly supported by Identity Providers today — OAuth2, OAuth2 Token Exchange, OIDC, SAML2 Browser Profile, WS-Trust, WS-Federation, etc. The OAuth2 and OIDC protocols are relative newcomers. The other protocols have been around longer — and, tend to…
Summary of Azure Active Directory OAuth2 Authorization Grant and OIDC Authentication Flow Uses
A while back I needed a summary of which protocols were supported/recommended in different situations by Azure Active Directory while I was researching the “When To Use Which (OAuth2) Grants and (OIDC) Flows” post. So, I am summarizing it here.