RFC 9068: A JWT-Based OAuth2 Access Token Format Standard
For anyone who has been paying attention, this blog post has been a long-time coming for multiple reasons. First, this is my first blog post in a couple of years — I’ve been heads down on a couple of projects for awhile now. This is literally the first time I’ve “come up for air” since the last…
OAuth2 Access Tokens vs API Keys — Using JWTs
There are several approaches to securing APIs. Every API Gateway vendor supports the same core set of API security mechanisms. API Keys and OAuth2 are two examples of these authentication (plus authorization) mechanism. When should one be used over the other? What are the differences between the…
OAuth2 Resource Owner Password Credential Grant with 3Scale and Red Hat SSO
This blog post continues demonstrating (and documenting) the use of the OAuth2 + OIDC Debugger with 3Scale API Management and Red Hat SSO. Now, we are going to look at the OAuth2 Resource Owner Password Credential Grant with 3Scale and Red Hat SSO.
OAuth2 Implicit Grant with 3Scale and Red Hat SSO
This post demonstrates the OAuth2 Implicit Grant with 3Scale SaaS, APICast Gateway, and Red Hat SSO v7.1. In the last post, we introduced these components and demonstrated a functioning OAuth2 Authorization Code Grant (and OpenID Connect Authorization Code Flow). This is all part of my 3Scale API…
OAuth2 Configuration in 3Scale API Management (and APICast) with Red Hat SSO
This tutorial builds on the capabilities we explored in the “Red Hat SSO + 3Scale API Management” series and in particular in the first tutorial. In this post, we will:
Red Hat SSO v7.1 OAuth2 Client Credentials Grant
This post continues our exploration of OAuth2 Authorization Grants with Red Hat SSO v7.1. In previous posts, we looked at:
Red Hat SSO v7.1 OAuth2 Resource Owner Password Credential Grant Support
In this post, we will look at an example of the OAuth2 Resource Owner Password Credential Grant using Red Hat SSO v7.1. In previous posts, I described the Red Hat SSO setup for OpenID Connect authentication and OAuth2. We have also looked at examples of:
OAuth2 Implicit Grant with Red Hat SSO v7.1
In my last post, we looked at how to configure Red Hat SSO v7.1 for OpenID Connect. That post also introduced a web-based OAuth2 + OIDC debugger and the OIDC Authorization Code Authentication Flow. The Red Hat SSO configuration that was created in that post also allows the OAuth2 Implicit Grant to…
Red Hat SSO v7.1 Spec Support
Red Hat SSO v7.1 provides support for OAuth2, OpenID Connect, and SAML2. There are numerous other identity protocols, but these are quite common and can handle a wide variety of use cases.
Understanding WS-Federation — Passive Requestor Profile
There are several identity protocols that are commonly supported by Identity Providers today — OAuth2, OAuth2 Token Exchange, OIDC, SAML2 Browser Profile, WS-Trust, WS-Federation, etc. The OAuth2 and OIDC protocols are relative newcomers. The other protocols have been around longer — and, tend to…
Summary of Azure Active Directory OAuth2 Authorization Grant and OIDC Authentication Flow Uses
A while back I needed a summary of which protocols were supported/recommended in different situations by Azure Active Directory while I was researching the “When To Use Which (OAuth2) Grants and (OIDC) Flows” post. So, I am summarizing it here.
JWT Use Cases
This post explores the equivalent JWT use cases corresponding to the five SAML2 use cases that were explored earlier in this series. We had to build up our tool set to get to this point — including exploring JWT, OAuth2, OpenID Connect, and the supporting specs. To be ready for this moment, we’ve…