Ohjelma
Keskiviikkona 11.11.
Introduction to OAuth, OpenID Connect and Modern Identity
- Authentication vs. Authorization
- OAuth evolution (OAuth 1.0 → OAuth 2.0 → OAuth 2.1)
- OAuth vs. OpenID Connect
- Common security challenges and identity architecture
Token Service and JWT Fundamentals
- Authorization Server, Relying Party and service endpoints
- Discovery document and server implementations
- Token types (Access, ID, Refresh, Bearer)
- JWT structure and validation
Authorization Flows and Token Security
- Authorization Code Flow (public vs. confidential clients, front- vs. back-channel)
- PKCE, State and Nonce
- Refresh Tokens and Token Introspection
- Why the Implicit Flow is deprecated
Claims, Scopes and Modern OAuth Patterns
- Claims, scopes and user consent
- Securing tokens (signatures, encryption, keys, algorithms)
- Client Credentials Flow
- Single Sign-On (SSO), Single Sign-Out (SLO), Backend for Frontend (BFF), OAuth 2.1 recommendations
Conclusion of the day