Blog

Writing on Identity & Security

Practical guides on OAuth 2.0, OpenID Connect, SAML, Keycloak, and the platform engineering behind identity systems.

595 posts · page 20 of 30

Jun 9, 20266 min readSecurityFeatured

AWS Security Hub, Config, and Audit Manager Compared

Compare AWS Security Hub, Config, and Audit Manager to understand their roles in cloud security, compliance, and conformance packs.

Part 3 · AWS Security Observability

Jun 8, 20266 min readSecurityFeatured

AWS Alerting: Fire on Real Threats

Stop the noise. Learn how to tune AWS EventBridge and GuardDuty rules to surface only actionable security events for SREs.

Part 2 · AWS Security Observability

Jun 7, 20266 min readDevelopmentFeatured

RFC 8414 Explained: OAuth 2.0 Authorization Server Metadata

RFC 8414 simplifies OAuth 2.0 integration by defining a standard mechanism for clients to discover authorization server metadata and endpoints automatically.

Part 1 · Authorization Server Metadata (RFC 8414)

Jun 6, 20266 min readDevelopmentFeatured

Angular OAuth2/OIDC Token Storage: localStorage, sessionStorage, and In-Memory

A technical examination of token storage strategies in Angular OAuth2 OIDC applications, analyzing the security implications of localStorage, sessionStorage, and in-memory options.

Part 5 · angular-oauth2-oidc in Production

Jun 5, 20266 min readDevelopmentFeatured

OAuth 2.0 Refresh Tokens in Angular: Silent Refresh with useRefreshTokens

A practical guide to managing access token expiration in Angular applications by leveraging userefreshtoken and setupautomaticsilentrefresh for uninterrupted user sessions.

Part 4 · angular-oauth2-oidc in Production

Jun 4, 20266 min readDevelopmentFeatured

Angular OAuth2/OIDC: loadDiscoveryDocumentAndTryLogin

A guide to implementing loadDiscoveryDocumentAndTryLogin and strict discovery document validation in Angular applications for secure authentication flows.

Part 3 · angular-oauth2-oidc in Production

Jun 3, 20266 min readDevelopmentFeatured

The AuthConfig Reference: Every Property That Matters

Configure the essential AuthConfig properties in Angular-OAuth2-OIDC. Learn how to set requireHttps, remoteOnly, and nonceStateSeparator for secure authentication.

Part 2 · angular-oauth2-oidc in Production

Jun 2, 20266 min readDevelopmentFeatured

CloudTrail, CloudWatch, and GuardDuty: Who Does What

A clear breakdown of how CloudTrail, CloudWatch, and GuardDuty function together to provide visibility and security in AWS environments.

Part 1 · AWS Security Observability

Jun 1, 20266 min readDevelopmentFeatured

angular-oauth2-oidc: Setting Up Code Flow With PKCE

Learn how to implement secure authentication in Angular using the code flow with PKCE extension via the angular-oauth2-oidc library.

Part 1 · angular-oauth2-oidc in Production

May 31, 20266 min readSecurityFeatured

Least Privilege in Practice

Learn how to enforce least privilege in AWS by leveraging IAM Access Analyzer, automated policy generation, and condition keys to minimize security risks.

May 30, 20266 min readSecurityFeatured

RFC 9700: The Mandatory Guardrails for OAuth 2.0

RFC 9700 establishes essential security guidelines for OAuth 2.0 implementations, addressing critical vulnerabilities like mix-up attacks and redirect URI handling.

Part 6 · OAuth 2.0 RFCs Every Engineer Should Read

May 29, 20266 min readDevelopmentFeatured

RFC 8693: Token Exchange, Delegation, and Impersonation

Explore RFC 8693's specifications for token exchange, delegation, and impersonation, essential for secure identity propagation in modern OAuth 2.0 architectures.

Part 4 · OAuth 2.0 RFCs Every Engineer Should Read

May 28, 20266 min readDevelopment

Implementing and Validating Discovery in Your Client

Learn how to securely implement OAuth 2.1 discovery in your client applications, focusing on issuer validation and strict discovery document validation to prevent authorization server attacks.

Part 6 · Authorization Server Metadata (RFC 8414)

May 27, 20266 min readDevelopmentFeatured

Decoding client_secret_basic Default in RFC 8414

RFC 8414 defines how authorization servers publish supported authentication methods. This post explores the default client_secret_basic method and its alternatives.

Part 4 · Authorization Server Metadata (RFC 8414)

May 26, 20266 min readtechnicalFeatured

Understanding OAuth2 Incremental Authorization

Learn how incremental authorization enhances the OAuth2 flow by requesting scopes progressively, optimizing scope management and consent UX.

Part 7 · OAuth 2.0 Security

May 25, 20266 min readtechnicalFeatured

Securing OAuth2 Bearer Token Usage: RFC 6750 Best Practices

Learn how to properly implement OAuth2 bearer tokens according to RFC 6750, including secure header usage and effective error handling strategies.

Part 2 · OAuth 2.0 & OIDC Mastery

May 24, 20266 min readtechnicalFeatured

Building Resilient Multi-Region IAM with Keycloak and AWS Global Accelerator

Learn how to implement a high-availability IAM solution across multiple regions using Keycloak and AWS Global Accelerator to ensure robust disaster recovery.

Part 5 · Multi-Cloud Identity

May 23, 20267 min readDevelopmentFeatured

Building Identity Abstraction Layer: Provider-Agnostic Authentication

Construct a decoupled authentication layer that normalizes identity data from OIDC, SAML, and LDAP into a unified internal model.

Part 2 · Identity Platform Architecture

May 22, 20266 min readtechnicalFeatured

Building a Centralized Audit Log for Identity Events with ELK Stack

Learn how to implement a centralized audit log for identity events using the ELK stack to enhance security monitoring and meet audit compliance requirements.

Part 2 · Identity Analytics & Observability

May 21, 20266 min readtechnicalFeatured

Implementing Identity Verification for KYC

Learn how to build effective identity verification systems for KYC compliance, covering digital identity proofing, document checks, and biometric authentication.