Security
5,347 items in 29 lists
-
OpenID Connect RP-Initiated Logout openid.net
Defines how a Relying Party can requests that the OpenID Connect provider log out the End-User by redirecting the End-User's User Agent to the OP's Logout Endpoint.
-
OpenID Connect Dynamic Client Registration openid.net
Mechanism for sender-constraining OAuth 2.0 tokens via a proof-of-possession mechanism on the application level which allows for the detection of replay attacks with tokens.
-
Initiating User Registration via OpenID Connect openid.net
Specifications for initiating user registration via OpenID Connect and create prompt.
-
OpenID Connect Front-Channel Logout openid.net
Logout mechanism that uses front-channel communication via the User Agent between the OpenID Connect provider (OP) and Relying Parties (RPs) being logged out that does not need an OpenID Provider iframe on Relying Party pages.
-
OpenID Connect Extended Authentication Profile (EAP) ACR Values 1.0 openid.net
Specifications for OpenID Connect Extended Authentication Profile (EAP) ACR Values which allows to request specific authentication methods and assurance levels.
-
OpenID Connect Discovery 1.0 openid.net
Mechanism for an OpenID Connect Relying Party to discover the End-User's OpenID Provider and obtain information needed to interact with it.
-
OpenID Connect Core 1.0 openid.net
Defines the core OpenID Connect functionality: authentication built on top of OAuth 2.0 and the use of Claims to communicate information about the End-User. It also describes the security and privacy considerations for using OpenID Connect.
-
OpenID Connect Back-Channel Logout openid.net
Logout mechanism that uses direct back-channel communication between the OpenID Connect provider (OP) and Relying Parties (RPs) being logged out.
-
OpenID Connect Client-Initiated Backchannel Authentication Flow - Core 1.0 openid.net
Specifications for Client-Initiated Backchannel Authentication (CIBA) flow.
-
JWT Secured Authorization Response Mode for OAuth 2.0 (JARM) openid.net
JWT-based mode to encode OAuth authorization response parameters with additional claims used to further protect the transmission.
-
FAPI 2.0 Security Profile openid.net
New version of the FAPI security profile that is suitable for protecting APIs with a high inherent risk in the context of Financial-grade APIs.
-
FAPI 2.0 Message Signing openid.net
API security profile for signing and verifying certain FAPI 2.0 Security Profile based requests and responses.
-
FAPI 2.0 Attacker Model openid.net
Security goals, attacker models and security mechanisms for Financial-grade APIs.
-
OpenID AuthZEN openid.net
Standardized API for requesting access decisions from an authorization service in order to ease integration between services.
-
OpenID openid.net
The OpenID Connect official website.
-
Curity Playground oauth.tools
Tools for exploring and testing OAuth and OpenID Connect flows.
-
OAuth oauth.net
The OAuth website maintained by Aaron Parecki which list different resources about the protocol.
-
OAuth Mock Server oauth.kogiqa.com
A free and open-source OAuth mock server that simulates the biggest providers just by replacing the URL. Useful for E2E testing.
-
OAuth.com Playground oauth.com
OAuth 2.0 / OpenID Connect Playground with authorization flows and step by step of the process of obtaining an access token.
-
Nacho nacho.cerberauth.com
An OAuth 2.0 client creation helper helping to choose the right grant type depending on the application.
-
com.nimbusds/oauth2-oidc-sdk mvnrepository.com
Java SDK developed by connect2id with OpenID Connect, FAPI, Federation and eKYC / Identity Assurance extensions.
-
MojoAuth: Passkey Playground mojoauth.com
Build and visualize OpenID Connect requests with this interactive tool. Configure parameters, generate request URLs, and decode JWT tokens.
-
Microsoft Entra ID microsoft.com
Software component developed by Microsoft providing single sign-on access to systems and applications.
-
Medium OAuth 2.0 medium.com
Medium blog with learnings, patterns and ideas around use of OAuth 2.0.
-
Keycloak keycloak.org
Open Source project powered by RedHat which provides user federation, strong authentication, user management, fine-grained authorization, and more.
-
IBM Verify ibm.com
OpenID Connect Provider and Identity as a Service (IDaaS) solution by IBM.
-
MCP OAuth 2.1 Authentication: How AI Agents Securely Connect to Tools iamdevbox.com
How the Model Context Protocol uses OAuth 2.1 with mandatory PKCE, RFC 8707 audience binding, and zero-configuration discovery for AI agent authentication.
-
IAMDevBox iamdevbox.com
Developer blog covering OAuth 2.0/2.1, OIDC, SAML, Keycloak, ForgeRock, and PingIdentity with hands-on tutorials and troubleshooting guides.
-
SAP Customer Identity help.sap.com
SAP's OpenID Connect Provider and Identity as a Service (IDaaS) solution.
-
Gravitee.io gravitee.io
Open Source OpenID Connect/OAuth 2.0 provider aims to be a bridge between applications and identity providers to authenticate, authorize and getting information about user accounts.
-
OpenID Foundation conformance suite gitlab.com
Test conformance suite to obtains OpenID Foundation certification which covers OpenID Connect, FAPI1-Advanced, FAPI2, FAPI-CIBA and OpenID for Identity Assurance (ekyc).
-
GitHub Actions OIDC – Non-Human Identities and Secretless Authentication eparon.me
A two-part guide on moving from static secrets to OIDC-based identities in GitHub Actions, including a practical lab for protecting APIs.
-
Duo duo.com
OpenID Connect Provider and IdP solution developed by Cisco.
-
Duende IdentityServer duendesoftware.com
ASP.NET Core OpenID Connect Provider solution.
-
Spring Security docs.spring.io
Java framework for securing Spring-based applications with OpenID Connect and OAuth 2.0 support.
-
Scalekit docs.scalekit.com
OpenID Connect provider for B2B applications, acting as the application's OpenID Provider (OP) for hosted enterprise SSO.
-
Kong OpenID Connect docs.konghq.com
OpenID Connect Relying Party plugin for the Kong API Gateway.
-
FrontEgg docs.frontegg.com
A Customer Identity solution for SaaS platform with OpenID Connect Provider capability.
-
Descope docs.descope.com
OpenID Connect Provider and Identity Federation solution that provides drag and drop user authentication and authorization flows.
-
Transmit Security developer.transmitsecurity.com
A CIAM solution that supports an OpenID Connect-based integration.
-
Okta Blog developer.okta.com
Okta vendor blog posts about OAuth 2.0 and OpenID Connect.
-
OAuth 2.0 Protected Resource Metadata datatracker.ietf.org
Metadata format that an OAuth 2.0 client or authorization server can use to obtain the information needed to interact with an OAuth 2.0 protected resource.
-
JWT Response for OAuth Token Introspection datatracker.ietf.org
A signed additional JSON Web Token (JWT) secured response for OAuth 2.0 Token Introspection.
-
OAuth 2.0 Demonstrating Proof of Possession (DPoP) datatracker.ietf.org
Demonstrates proof of possession of the client's private key for OAuth 2.0.
-
OAuth 2.0 Rich Authorization Requests (RAR) datatracker.ietf.org
Extends OAuth 2.0 authorization requests with additional authorization_details parameter that allows clients to specify their fine-grained authorization requirements using the expressiveness of JSON data structures.
-
OAuth 2.0 Authorization Server Issuer Identification datatracker.ietf.org
Defines a new iss parameter in the authorization response in order to identify the authorization server that issued the authorization response and mitigates mix-up attacks.
-
OAuth 2.0 Pushed Authorization Requests datatracker.ietf.org
Pushed authorization request (PAR) allows clients to push the payload of an OAuth 2.0 authorization request to the authorization server via a direct request.
-
OAuth 2.0 JWT-Secured Authorization Request (JAR) datatracker.ietf.org
Allows to send request parameters in a JSON Web Token (JWT), which can be signed with JSON Web Signature (JWS) and encrypted with JSON Web Encryption (JWE) so that the integrity, source authentication, and confidentiality properties of the authorization request are attained.
-
JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens datatracker.ietf.org
JWT format and validation specifications in the context of OAuth 2.0.
-
Resource Indicators for OAuth 2.0 datatracker.ietf.org
A mechanism that allows an OAuth 2.0 client to indicate the resource server that it intends to access.
- next page of items loading…
