To Identity and Beyond
summary
Explains the auth code flow: two redirects during login, exchange auth code plus client secret for an id token, access token and optional refresh token; access tokens carry scopes and audience, id tokens assert subject for linking users. Describes OAuth 2.0 vs the identity layer OpenID Connect, why OIDC standardizes the userinfo format, and how tokens are JWTs (three base64url parts, header/payload/signature, HMAC‑SHA256 vs RSA256, exp/iat). Recommends adding token-based auth early and cites a migration to Auth0 that freed a 13-person identity team.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 1:10Where did identity start
- 4:09Behind the scenes
- 6:25What is OAuth
- 9:54What is Authorization
- 16:02OpenID Connect
- 21:07JSON Web Tokens
- 29:40Questions
related talks
28mOAuth 2.0 and OIDC
33mOAuth and OpenID Connect Deep Dive
05mIntroducing the Identity Guardians - Auth tokens in a flash!
58mOAuth – the good Parts
27mIntegrating API Security Into A Comprehensive Identity Platform
29mFireside Chat About OAuth 2.0
45mDemystifying OAuth2 and OIDC
49mUnderstanding OAuth 2.0 & OIDC