OpenID Connect Flows
Learn about OpenID Connect's authorization code, implicit, and hybrid flows. See how each flow works, when to use it, and how to secure it.| Scott Brady
Learn about OpenID Connect's authorization code, implicit, and hybrid flows. See how each flow works, when to use it, and how to secure it.| Scott Brady
Understanding silent refresh and how to implement it using Angular CLI and oidc-client| Scott Brady - scottbrady.io
How to add authentication to an Angular SPA using the oidc-client OpenID Connect client library| Scott Brady - scottbrady.io
Tutorial for getting the node oidc-provider library up and running.| Scott Brady - scottbrady.io
How to use IdentityServer with WS-Federation as a Trusted Identity Provider in SharePoint 2013.| Scott Brady - scottbrady.io
Using Cloudflare Origin Certificates within Azure App Services using a pfx via openssl| Scott Brady - scottbrady.io
Configuring ASP.NET Core application settings when running within Docker containers| Scott Brady
An explanation of the various OpenID Connect endpoints and what they can be used for.| Scott Brady
A beginners guide to IdentityServer and OpenID Connect, starting with an empty project and ending with a near production ready environment.| Scott Brady
Learn how OpenID Connect (OIDC) extends OAuth 2 by adding a layer of identity, solving user authentication and Single Sign-On (SSO).| Scott Brady
A review of the changes in 2024 and my plans for 2025.| Scott Brady - scottbrady.io
A modern overview of the WS-Federation protocol, focussing on the parts of the protocol that are still in use and somewhat useful to know.| Scott Brady - scottbrady.io
A review of the changes in 2023 and my plans for 2024.| Scott Brady - scottbrady.io
An overview of the book “An Elegant Puzzle: Systems of Engineering Management” by Will Larson, including some of my key takeaways, how they relate to my own experience, and what I am trying to implement as a result.| Scott Brady - scottbrady.io
How to create your own RSA key in .NET or load one from a JSON Web Key, a PEM file, or an X.509 certificate.| Scott Brady - scottbrady.io
Implementing AES with ECB and CBC block cipher modes and brute-force decrypting your first encryption oracle.| Scott Brady - scottbrady.io
A review of the changes in 2022 and my plans for 2023.| Scott Brady - scottbrady.io
An overview of the book “The Making of a Manager: What to Do When Everyone Looks to You” by Julie Zhou, including some of my key takeaways, how they relate to my own experience, and what I am trying to implement as a result.| Scott Brady - scottbrady.io
Learn the pros and cons of each OAuth client authentication mechanism and take your OAuth security beyond client secrets.| Scott Brady
An overview of the book 'The Art of Leadership' by Michael Lopp, including some of my key takeaways, how they relate to my own experience, and what I am trying to implement as a result.| Scott Brady
Learn how to create and validate JSON Web Tokens (JWTs) in Python using the Authlib library, JWT security best practices, and claims validation.| Scott Brady
Learn how JSON Web Encryption (JWE) works with a walkthrough of the token format, best practices, and the encryption algorithms available to you.| Scott Brady
Learn how to use JWTs securely with my latest course on Pluralsight: JWT Fundamentals.| Scott Brady - scottbrady.io
Learn how the UK's Open Banking makes use of OAuth and OpenID Connect.| Scott Brady
Learn how to implement and trigger standards-based step-up authentication using OAuth, OpenID Connect, and SAML.| Scott Brady
A review of the changes in 2021 and my plans for 2022.| Scott Brady - scottbrady.io
How to log into an Umbraco website as an end-user via an external SSO solution such as IdentityServer, Google, or Auth0.| Scott Brady - scottbrady.io
Why I have left Rock Solid Knowledge, what I’m doing in my new job at 10x Banking, and what, if anything, will change on this website.| Scott Brady
A deep dive into OpenID Connect’s ID token, looking at what identity tokens are, what they are not, where to use them, and how to validate them.| Scott Brady
How to log into the Umbraco backoffice using an external identity provider such as IdentityServer, Azure AD, or Auth0.| Scott Brady - scottbrady.io
Polywork is a new social media platform that I’ve been using to track my recent achievements, both big and small, and to tackle my ongoing impostor syndrome.| Scott Brady
How to sign XML in .NET and .NET Core using an RSA key while avoiding common XML security pitfalls.| Scott Brady
Drag your XML signing into the 2020's with modern cryptography by signing XML with ECDSA.| Scott Brady
Four different ways of loading Elliptic Curve (EC) keys in .NET for use with Elliptic Curve Digital Signature Algorithms (ECDSA).| Scott Brady
I’m an Umbraco MVP for 2021! This was awarded in recognition of my contributions to the Unicore project, where Rock Solid Knowledge helped Umbraco migrate their user store to ASP.NET Core Identity.| Scott Brady
Learn how OAuth Proof-Key for Code Exchange (PKCE) does not replace client authentication (e.g. secrets) and why you should use both where possible.| Scott Brady
Learn how to use AES-GCM encryption in .NET for authenticated encryption, giving you the usual confidentiality and an additional integrity check.| Scott Brady
Learn how password shucking attacks rehashed or pre-hashed passwords by stripping your password hashes of their strong outer password hashing algorithm.| Scott Brady
Learn how to automatically set HTML passwordrules based on your ASP.NET Identity password options, using the newpassword tag helper from ScottBrady.IdentityModel.| Scott Brady - scottbrady.io
Learn how to integrate sign up forms with password generators by using the autocomplete and passwordrules HTML attributes.| Scott Brady - scottbrady.io
SAML is the protocol that no one wants to use. But if you must use it, at least you now have a modern, detailed introduction to SAML thanks to my new Pluralsight course.| Scott Brady - scottbrady.io
A review of what little I got up to in 2020 and my plans for 2021.| Scott Brady - scottbrady.io
Avoid a common OAuth pitfall by learning how OAuth consent and access tokens differ from user-level authorization policies.| Scott Brady
Learn the introductory theory behind XChaCha20-Poly1305, a standby cipher for symmetric encryption, and how to use it in .NET with libsodium or implement it yourself by 'rolling your own crypto' on top of Bouncy Castle.| Scott Brady
Learn how to load keys and certificates from PEM files in .NET. With code samples showing the new APIs added in .NET 5 and how to use PEM certificates with Kestrel.| Scott Brady
My talk from NDC Oslo 2020. Learn how current user authentication isn't good enough and how you can solve the password problem with FIDO2 and WebAuthn.| Scott Brady - scottbrady.io
Learn the difference between each JOSE algorithm (e.g. RS256, ES256, EdDSA) and how to choose the best one available to you.| Scott Brady
An OpenSSL cheat sheet for creating RSA private keys, public keys, and certificates for use with RSASSA-PKCS1-v1_5 and RSASSA-PSS.| Scott Brady
My experience and highlights from the OAuth Security Workshop 2020. Including new OAuth topics such as online_access, app2app, FAPI, OAuch, and Web ID.| Scott Brady - scottbrady.io
How to use ES256 to sign JWTs in IdentityServer4 while still supporting RS256 for backward compatibility.| Scott Brady
An OpenSSL cheat sheet for creating EC private keys, public keys, and certificates for use with ECDSA.| Scott Brady
How to use Tailwind CSS and Bootstrap 4 side-by-side.| Scott Brady - scottbrady.io
Physical biometrics, such as fingerprint or facial recognition, are super useful when logging into mobile apps. So why can't you use biometrics in the browser?| Scott Brady - scottbrady.io
A primer on EdDSA and how to use it for JWT signing in .NET Core using Bouncy Castle and ScottBrady.IdentityModel.| Scott Brady
Branca, PASETO, XChaCha20-Poly1305, and Base62 support in .NET Core using ScottBrady.IdentityModel.| Scott Brady
JWTs get a lot of hate from the crypto community, but what are the alternatives? In this article, I look at implementations such as Branca and PASETO to see how they compare to JWTs.| Scott Brady
How to outsource IdentityServer4 JWT signing to Azure Key Vault. No private keys were downloaded in the making of this article.| Scott Brady - scottbrady.io
My experience with OpenSK, an open-source FIDO2 authenticator implementation, using a VirtualBox VM and FIDO2 for ASP.NET.| Scott Brady
New features in IdentityManager2 with ASP.NET Core 3.1 and SameSite cookie support.| Scott Brady - scottbrady.io
Learn how Evilginx can phish common multi-factor authentication implementations, and how you can defeat it using FIDO2.| Scott Brady - scottbrady.io
Give your ASP.NET 4.x apps a refresh with the latest OWIN updates and Proof Key for Code Exchange| Scott Brady
A nostalgic review of what I got up to in 2019 and plans for 2020.| Scott Brady - scottbrady.io
How to implement custom signing algorithms for JWT validation in .NET Core, with examples using ES256K and Bouncy Castle.| Scott Brady
Cheat sheet for using Nimbus JOSE + JWT to create signing keys, generate signed JWTs, and verify JWT signatures. Examples use ES256K and EdDSA (Ed25519)| Scott Brady
Getting started with mkcert for IIS TLS certificates and ASP.NET Core client certificate authentication| Scott Brady
New Pluralsight course on all things user authentication and how to implement them in ASP.NET Core| Scott Brady - scottbrady.io
A look at the new RSASSA-PSS support in .NET Core and what benefits it has over RSASSA-PKCS1-v1_5| Scott Brady
A primer on Sign in with Apple, including an example integration in ASP.NET Core.| Scott Brady
Why you should use SAML's SP-initiated SSO rather than Idp-initiated SSO and unsolicited SAML responses.| Scott Brady - scottbrady.io
How to roll your own SRP client and server using C# and .NET Core| Scott Brady - scottbrady.io
How to encrypt identity tokens in IdentityServer4 and decrypt them in ASP.NET Core.| Scott Brady
How to generate a cryptographically random string in Dart, suitable for OAuth and OpenID Connect usage| Scott Brady - scottbrady.io
My solutions to the Cryptopals Crypto (Cryptography) Challenges using C# and .NET.| Scott Brady
Implementing your own Base64 encoder, dealing with hex strings, bit handling, and sextets.| Scott Brady
Implementing and breaking XOR-based versions of the Caesar and Vigenère Ciphers in C# and .NET.| Scott Brady
Implementing OAuth support in Ktor & Kotlin to get access tokens from IdentityServer4| Scott Brady - scottbrady.io
A rebuttal to Okta's 'Nobody Cares About OAuth or OpenID Connect', advocating the education and involvement of developers with OAuth and OpenID Connect.| Scott Brady
How to add support for PKCE to your ASP.NET Core OpenID Connect client application.| Scott Brady
A cheat sheet for choosing the right way to securely access an API when using a browser-based application such as a JavaScript SPA.| Scott Brady - scottbrady.io
Learn how to encrypt JSON Web Tokens with JSON Web Encryption in C#, .NET, and ASP.NET Core.| Scott Brady
Migrating your oidc-client-js SPA from the OpenID Connect implicit flow to authorization code flow with PKCE.| Scott Brady - scottbrady.io
A look at the advantages and disadvantages of using software tokens as an authentication factor, focussing on TOTP.| Scott Brady - scottbrady.io
A brief review of what I've been up to since 2016, including plans for 2019.| Scott Brady - scottbrady.io
How to keep your DBA happy by implementing your own IdentityServer4 data store.| Scott Brady - scottbrady.io
Removing application passwords from OAuth by using JWT Bearer Tokens, including ASP.NET Core and IdentityServer4 usage.| Scott Brady
How to handle delegation scenarios using OAuth Token Exchange, for use with microservices and API gateways.| Scott Brady
It's not the identity provider, it's you. Methods for debugging redirect loops when using OpenID Providers such as IdentityServer4.| Scott Brady - scottbrady.io
Announcing my new Pluralsight course, in which we take a look at OAuth 2.0, the gold standard for API authorization.| Scott Brady - scottbrady.io
Recording from .NET South West looking at how to protect an Angular application using OpenID Connect| Scott Brady - scottbrady.io
An introduction to IdentityManager2, including ASP.NET Core Identity, and IdentityServer4 integration.| Scott Brady
Getting to grips with FIDO2 and WebAuthn, including a basic implementation in ASP.NET Core| Scott Brady
How to keep your Swagger UI test tool working after protecting your API using IdentityServer 4 (OAuth).| Scott Brady - scottbrady.io
A cautionary tale of reinventing the wheel and history repeating itself in the name of blockchain| Scott Brady - scottbrady.io
The reasons why OAuth is not an authentication protocol, and why without using open standards such as OpenID Connect, should not be hacked to become one.| Scott Brady
One of the few legitimate uses for the ROPC grant type is for browserless devices. Luckily, the OAuth working group now has a solution for that.| Scott Brady - scottbrady.io
How to use passwordless authentication via one-time, user specific login links sent via email. Just like Medium!| Scott Brady - scottbrady.io
A technical review of the Civic SIP, from the perspective of an identity and authentication professional| Scott Brady
Integrating with Civic SIP using an ASP.NET Core web application| Scott Brady - scottbrady.io
How to sign and verify a JSON Web Token (JWT) using Elliptic Curve Digital Signature Algorithms (ECDSA) in .NET Core| Scott Brady
Verifying JSON Web Tokens usng the Java-JWT library and protecting access to a Ktor API| Scott Brady
