Should a system require a password confirmation for accounts managed by an administrator?

Suppose you have a user account management subsystem with a web UI. You can change user account passwords in regular masked input password fields in HTML POST forms. I’m wondering, is it fine if such forms have password confi… Continue reading Should a system require a password confirmation for accounts managed by an administrator?

What are the pieces of information delivered in a user profile at the end of a OpenID Connect flow?

From what I understand about using OpenID Connect (over OAuth2), is that we end up with some JSON containing information about the user. That information is transported as a JSON Web Token.

➥ What are the pieces of informa… Continue reading What are the pieces of information delivered in a user profile at the end of a OpenID Connect flow?