Tales of OAuth2/OIDC in the wild
summary
Shows concrete failures and fixes: Microsoft ENT ID expands nested groups into ID tokens and limits group entries to about 200 to avoid header overflow, so ID tokens bloat into the hundreds; use the userinfo endpoint to keep ID tokens small and refreshable. Demonstrates issuer mismatches (templated tenant IDs in discovery), ADFS using different issuers for access and ID tokens, Azure AD B2C producing policy-specific issuers, and cloud providers forcing an identity-translation layer or IdentityServer proxy that works but creates brittle hacks. Also notes RFC quirks that break client secrets with plus signs.
AI-written summary · about
chapters (13)
- 0:00OAuth2/OIDC stories intro
- 0:53Why OAuth2/OIDC specs matter
- 3:25Token size challenges in OIDC
- 9:52Entra ID token size limits
- 13:26Issuer validation issues
- 17:04Multi-tenancy in Entra ID
- 24:07ADFS issuer inconsistencies
- 26:32Single sign-out importance
- 29:49Google’s missing logout endpoint
- 30:32Identity provider pitfalls
- 36:58Cloud IdP limitations
- 37:40Spec clarifications & auth issues
- 40:10Q&A
related talks
45mDemystifying OAuth2 and OIDC
57mBuilding Clients for OpenID Connect/OAuth 2-based Systems
01h 02mOpenID Connect & OAuth 2.0 – Security Best Practices
59mDemystifying OAuth, JWTs and Azure AD
53mOAuth2/OIDC security weaknesses and pitfalls
01h 00mImplementing OpenID Connect and OAuth 2.0 – Tips from the Trenches
01h 00mOAuth – the good Parts
01h 00mSupercharging OAuth 2.0 Security