Implementing OpenID Connect and OAuth 2.0 - Tips from the Trenches - Dominick Baier

Don't forget to check out our links below!
ndcporto.com/
ndcconferences.com/
There are typical architectural patterns around identity & access control for modern applications (micro services or cloud-native apps - or whatever you like to call them). OpenID Connect and OAuth 2.0 are the enabler for these architectures. When building such an application system, you will inevitably run into some challenges and questions like which protocol flow to choose, how to design your resources and tokens, how to connect your various (new and old) clients to the token-based system, how to design session and token lifetime management, how to deal with revocation, authentication vs authorization etc.
In this session we will have a look at some common patterns (and maybe anti-patterns) on designing token-based systems and get some answer for the above questions.

[@santiagocavanna]

Thanks for sharing this information. I found it very clear and useful. I am doing some work as IAM Arch and not always it is clear the path.

[@volkerdr.milbrandt7692]

- The less claims you need the better. - Only introduce scopes when you need them. - Resource Indicators spec to define relation between resources and scopes can now used to separate tokens between APIs

[@volkerdr.milbrandt7692]

OAuth 2.1 protocol flows start 27:38 - changed and simpified: only remaining authorization code flow and client credential work flow