OAuth2 and SAML(RFC 7522): When Your Assertion Needs a Passport
Note, We are exclusively talking about SAML2 in this story.
Read article: OAuth2 and SAML(RFC 7522): When Your Assertion Needs a PassportStandards & Specs
14 articles tagged Standards & Specs.
OAuth2 JWT Bearer Tokens (RFC-7523): When a JWT Becomes Your OAuth2 Credential
OAuth2 has a fairly straightforward model. A client authenticates to an authorization server, obtains an access token, and uses that token to access a protected resource.
Read article: OAuth2 JWT Bearer Tokens (RFC-7523): When a JWT Becomes Your OAuth2 Credential
Why Do Cryptographic Standards Pick Specific Elliptic Curves?
There are an almost ridiculous number of elliptic curves.
Read article: Why Do Cryptographic Standards Pick Specific Elliptic Curves?
OAuth2 + OIDC: All of the Specs (2026 Edition)
Current as of August, 2026.
Read article: OAuth2 + OIDC: All of the Specs (2026 Edition)
OpenID Federation Spec: Because Exchanging Metadata Spreadsheets Was Apparently Not a Great…
Or: How the Identity Industry Invented a Cryptographically Signed Phone Book
Read article: OpenID Federation Spec: Because Exchanging Metadata Spreadsheets Was Apparently Not a Great…
How Many IETF RFCs Actually Become Standards?
The Internet Engineering Task Force (IETF) has 10K+ published Request For Comments (RFCs) documents. The industry hears about RFCs all the time. But, as the name implies (“request for comments”) that isn’t the final step in the process. A very small number of RFCs are promoted to Internet…
Read article: How Many IETF RFCs Actually Become Standards?
Kerberos v5 Related Specs and RFCs
This post lists all of the related RFCs and specifications to Kerberos v5 that have been published over the years. It is part of my Kerberos and Windows Security Series. When I was researching this series, finding all of this information together in one place was quite challenging. As noted in my…
Read article: Kerberos v5 Related Specs and RFCs
Red Hat SSO v7.1 Spec Support
Red Hat SSO v7.1 provides support for OAuth2, OpenID Connect, and SAML2. There are numerous other identity protocols, but these are quite common and can handle a wide variety of use cases.
Read article: Red Hat SSO v7.1 Spec Support
SOA Specs Visualized
In a previous blog post, I listed a number of SOA Specs and Security Specs that I thought were important to be familiar with when working with DataPower and other SOA technologies. In this post, I made a quick (and dirty) Visio diagram that I tend to draw up on a whiteboard when I’m at a new client…
Read article: SOA Specs Visualized
What is a Service Consumer?
A Service Consumer is any tier of an organization’s systems that calls web services. These services could be implemented by SOAP, REST, XML over HTTP, EJBs, JMS or MQ applications, RMI, RPC, invocation of COBOL programs on a mainframe with 3270 screen-scraping, communication over a custom TCP…
Read article: What is a Service Consumer?