OpenID Connect Architectural Patterns

on YouTube ↗57m

" summary

Demo shows implemented OpenID Connect flows using .NET 9 with pushed authorization requests, shows SSO working across two web apps and exposes the problem: naive logout only clears the app cookie and users immediately reauthenticate; solution uses end_session redirect with ID token hint and back-channel logout to revoke sessions when Safari blocks third‑party cookies (affects ~30% of users). Also builds a federation gateway that brokers Android ID / Microsoft Entra ID / custom providers and compares tenant models (single issuer with tenant claim vs separate issuer per tenant).

AI-written summary · about

" chapters (14)

1. 0:00OpenID Connect patterns
2. 3:21Basic auth flow
3. 7:07Single sign-on and sessions
4. 9:58Single logout challenge
5. 13:08CSRF protection in logout
6. 16:03Post-logout redirect URIs
7. 22:51Safari cookie restrictions
8. 25:05Back-channel logout
9. 30:10Federation gateway pattern
10. 34:30Federated sign-out complexity
11. 39:14Identity provider selection UX
12. 43:09Multi-tenancy patterns
13. 49:29Entra ID multi-tenant handling
14. 50:36Summary of patterns

" related talks

• 57mBuilding Clients for OpenID Connect/OAuth 2-based SystemsDominick Baier, Brock Allen · NDC Porto 2019
• 54mOpenID Connect In DepthKevin Dockx · .NET Fest 2019
• 47mWho's your user? OpenID from the ground-upJohannes Brodwall · NDC Oslo 2020
• 58mOAUTH, OPENID CONNECT & .NET – THE GOOD PARTSAnders Abel · NDC London 2024
• 39mSecuring your apps with OAuth2 and OpenID ConnectRoland Guijt · Codemotion Rome 2015
• 31mAuthentication with OpenID Connect in Angular ApplicationsPhilippe De Ryck · NG-BE 2019
• 54mWho's your user? OpenID from the ground-upJohannes Brodwall · Build Stuff 2019
• 58mBuilding JavaScript and mobile/native Clients for Token-based ArchitecturesDominick Baier, Brock Allen · NDC London 2017