Blog
Articles, tutorials, and field notes on identity, integration, API management, and application security — spanning nearly two decades of hands-on work.
OpenID Connect Logout
The OpenID Connect (OIDC) family of specs supports logout (from a single application) and global (or single) logout (from all applications that the user has logged into through the OpenID Provider, OP), but these features are optional or in draft status (as of Q2, 2017). So, these spec features may…
SAML2 Use Cases
The following blog posts discuss SAML2 use cases that have been explored in this series:
Identity Propagation in an API Gateway Architecture
The power of end-to-end user security context with APIs
When To Use Which (OAuth2) Grants and (OIDC) Flows
Update(07/01/2019): This is by far my most popular post. I’ve continued to update this article based on feedback and things that I have noticed. I’m trying to keep it relevant.Please leave feedback in the comments section.
An Alternative to Delegated Access in the Enterprise
Extending OAuth2 and OpenID Connect as the enterprise standard for API security
Understanding OpenID Connect Series
The following blog posts make up my series on OpenID Connect. This is part of the SAML2 vs JWT series.
SAML2 vs JWT: Understanding OpenID Connect Part 3
In part 1 and part 2 of Understanding OpenID Connect, core concepts and the first Authentication Flow (Authorization Code Grant Flow) were introduced. In part 3, we look at the remaining Authentication Flows (Implicit Flow and Hybrid Flow) and some other features of the OIDC specification.
SAML2 vs JWT: Understanding OpenID Connect Part 2
This post continues our discussion of OpenID Connect (OIDC). We look at one of the three Authentication Flows defined by the OIDC spec — the Authorization Code Grant Flow.
SAML2 vs JWT: Understanding OpenID Connect Part 1
This post builds upon what we learned about OAuth2 and JWT in previous posts. OpenID Connect will give us the final building block for the JWT-related use cases that this series will explore. The goal of this blog post is to provide a deep understanding of the OpenID Connect spec without having to…
Design Principles for Seamless User Authentication
This post was originally published as “Design Principles for Seamless User Authentication” on the Apigee Blog.
Keeping Your APIs Secure for Multiple User Types
This post was originally published as “Keeping Your APIs Secure for Multiple User Types” on the Apigee Blog.
The Tools of API Management — The Full Stack
In the first three API Management posts I wrote, we discussed “What are APIs?(The Technical Perspective)”, “What is API Management?”, and “The Anatomy of an API Management Solution”. Continuing with this theme, we will explore the API Management Stack. So, what do I mean by API Management Stack?