Collaborate Disseminate
The Google Identity openid discovery url https://accounts.google.com/.well-known/openid-configuration, has a .jwks_uri of https://www.googleapis.com/oauth2/v3/certs. If we look at the first key in that JWK Set
curl -s https://www.googleapi… Continue reading Azure AD has an "issuer" attribute on JWK keys in the JWK Set but Google ID does not, what is its purpose?
OIDC says mTLS can be used to authenticate the client. But I haven’t read anywhere whether the OIDC Provider is supposed to accept self-signed SSL certificates. Are there any dangers to accepting self-signed certificates? Should these self… Continue reading mTLS with OpenID Connect and validating self-signed certificates
I am designing an new web application with a web-api backend. We want to try using OpenID Connect and we are looking into the best way to authorize the user for the API.
Setup:
User logs in into front-end and gets an OAUTH token.
Send OAU… Continue reading Passthrough authorization from web-application to web-api
I am designing an new web application with a web-api backend. We want to try using OpenID Connect and we are looking into the best way to authorize the user for the API.
Setup:
User logs in into front-end and gets an OAUTH token.
Send OAU… Continue reading Passthrough authorization from web-application to web-api
When I want to use encrypted request object with OpenID Connect then my OIDC provider must know my client_secret (used in JWT request object encryption). For the server to decrypt this object, that is, it has to store unencrypted client_se… Continue reading Encrypted request object in OpenID Connect
Recently, I started to wonder if OpenID Connect is really secure enough. I have analyzed tons of different sites and official documentation and so far I don’t see any problems except that stealing user sessions from one client can lead an … Continue reading OpenID Connect security issues
I am implementing OAuth (more specifically "Sign in with Google") for a website that has been using only email and password for years.
Now the guide that I’m reading suggests to read the uid in the OAuth callback. However the exi… Continue reading Is it safe to use email from OAuth for authentication?
If oauth2 is used with the state parameter (I know it’s not required by the standard), wouldn’t this ensure freshness, i.e. that authentication just happened? What additional security can OIDC bring?
We are using Forgerock OpenAM for managing authentication and authorization and I was wondering if it is possible to use this configuration:
Domain 1 -> App 1 -> Use SAML2
Domain 1 -> App 2 -> Use OpenID Connect
Domain 2 ->… Continue reading Can I combine OpenID Connect and SAML2 protocols in OpenAM
We are retrieving external users using OpenID with the PKCE flow. We are using the JWT returned from the auth server to authenticate the user. If it is valid, we extract the subject field from the token and use it as an ID in our users tab… Continue reading Can I store subject from a JWT from an external auth server in my DB?