Technical articles, standards guidance, and community insight on IAM, PAM, and Zero Trust.
OAuth & OIDCYour organization is deploying a digital wallet or credential issuance system. Your counterparty s implementation claims to support OpenID for Verifiable Presentations (OpenID4VP) and OpenID for Verif
OAuth & OIDCWhat Happened CISA and NIST released Interagency Report 8587 in response to a shift in how attackers target identity infrastructure. The report highlights a pattern: tokens and assertions, which prove
OAuth & OIDCThe question at hand Your Conditional Access policies probably don t cover device-code authentication . That s a problem because attackers are using Microsoft s OAuth 2.0 device authorization grant fl
OAuth & OIDCYour OpenID Connect infrastructure will need post-quantum signatures. The question isn t whether to migrate, it s which migration path matches your current constraints and risk tolerance. The Decision
Get weekly security insights and compliance updates delivered to your inbox.
OAuth & OIDCYour team might see token security as just an IAM configuration issue. You build authorization policies, enforce token lifetimes, and audit access logs. Then a contractor s laptop ends up in a GitHub
OAuth & OIDCThe OpenID Foundation approved OpenID Connect Key Binding 1.0 as an Implementer s Draft with 73 votes in favor, 5 against, and 20 abstentions. For IAM architects, this approval signals a shift from be
OAuth & OIDCYou ve got OAuth 2.0 working for your mobile app. Users authenticate, get tokens, and call APIs. Everything s smooth. Then, your product team wants users to tap a button in the app and land in a web v
OAuth & OIDCScope This guide explores OpenID Connect Key Binding, a proposed Implementer s Draft under review by the OpenID Foundation . We ll discuss what the specification addresses, how it differs from existin
OAuth & OIDCThe Australian Department of Finance s consultation on verifiable credentials policy closed with a clear warning from the OpenID Foundation s Australian Digital Trust Community Group: prioritize inter
OAuth & OIDCMicrosoft customers are experiencing a 15x increase in device code phishing attacks this year, according to Push Security . These attacks exploit OAuth 2.0 s Device Code Authorization Grant, facilitat
OAuth & OIDCIf you re implementing OpenID for Verifiable Presentations (OpenID4VP) or OpenID for Verifiable Credential Issuance (OpenID4VCI) , you need a clear path from development to public certification. The O
OAuth & OIDCYou re building a digital identity system that needs to work across multiple sectors, integrate with government frameworks, and remain viable as standards evolve. The shift from prescriptive architect
OAuth & OIDCWhat Happened A study by the FIDO Alliance and HID surveyed 500 IT and cybersecurity decision-makers across five countries and sectors. The research highlighted a significant gap: 94% of organizations
OAuth & OIDCWhen your AI agent needs to book a hotel, approve a transaction, or access member-only data, you re managing authentication, authorization, and transaction approval across different trust levels. OAut
OAuth & OIDCThe OpenID Foundation has launched self-certification for OpenID4VP and OpenID4VCI conformance tests. Some teams will certify quickly, while others will face delays due to preventable errors. The key
OAuth & OIDCThe Challenge A customer-support chatbot needs to access payment history and account details from multiple backend services. The user initiates the conversation, but an AI agent decides which tools to
OAuth & OIDCYou ve spent years building OAuth flows, SPIFFE identities, and OIDC federation. Now, AI agents are spinning up in production, and your first instinct is to treat them as a new problem needing new sta
OAuth & OIDCUnderstanding the Issue This isn t about a security breach. It s about a common architectural oversight that occurs before incidents happen, when teams deploy agentic systems without using token excha
