Dominick Baier
where else to find them
website:https://www.duendesoftware.com
github:leastprivilege
bluesky:duendesoftware.com
linkedin:dominickbaier
speakerdeck:leastprivilege
what they talk about
all 5 in the filters
where they keep going back
- NDC London5 editions2017–2021
- NDC Oslo5 editions2017–2023
- NDC Porto2 editions2019–2022
all 9 in the filters
on a stage with
- Brock Allen7×
- Steinar Noemonce
who talks about the same things
- Brock Allen11 talks
- Anders Abel14 talks
- Roland Guijt7 talks
- Nahid Farrokhi3 talks
- Tobias Ahnoff8 talks
- Aaron Parecki13 talks
| title | conference | date |
|---|---|---|
| PAR: Securing the OAuth and OpenID Connect Front-Channel | NDC Security 2024 | 2024-01-09 |
Pushed Authorize Requests move all authorization parameters from the browser URL into a back‑channel PAR endpoint so the client authenticates before the… | ||
| OAuth and Proof of Possession - The long way round | NDC Oslo 2023 | 2023-05-22 |
OAuth finally gets sender-constrained tokens in two concrete ways: mutual TLS (speced 2020) binds an access token via the CNF x5t#S256 thumbprint to a client… | ||
| OAuth and the long way to Proof of Possession | NDC Security 2023 | 2023-01-16 |
OAuth lacked cryptographic binding for a decade and now two practical options exist: mutual TLS and DPoP proof JWT. Mutual TLS binds tokens by embedding an… | ||
| Securing SPAs and Blazor Applications using the BFF (Backend for Frontend) Pattern | NDC Security 2023 | 2023-01-16 |
Claim: move OAuth tokens out of the browser into a server-side BFF to avoid XSS and broken iframe tricks; demo shows an ASP.NET Core BFF issuing same-site… | ||
| OAuth – the good Parts | NDC Porto 2022 | 2022-04-25 |
OAuth has a first major revision after 10 years: OAuth 2.1 removes obsolete flows and standardizes two practical paths — machine-to-machine (client_credentials… | ||
| Securing SPAs and Blazor Applications using the BFF (Backend for Frontend) Pattern | NDC Porto 2022 | 2022-04-25 |
Charts the shift from implicit tokens to a server-side BFF and shows a working ASP.NET Core prototype that stores only an httpOnly cookie front-to-back… | ||
| OAuth – the good Parts | NDC Oslo 2021 | 2021-11-29 |
OAuth has settled on a small set of practical rules: the ecosystem centers on two flows — client credentials flow for machine‑to‑machine and authorization code… | ||
| Using the BFF pattern to secure SPA and Blazor Applications | NDC Oslo 2021 | 2021-11-29 |
Argues that SPAs and Blazor must stop storing OAuth tokens in the browser and adopt a full BFF where ASP.NET Core + the OpenID Connect handler keep tokens… | ||
| OAuth in 2021 – What’s up? | NDC London 2021 | 2021-01-25 |
OAuth 2.1 consolidates best practices and removes legacy options: implicit and password flows removed, authorization code requires PKCE (proof key), redirect… | ||
| OpenID Connect & OAuth 2.0 – Security Best Practices | NDC Oslo 2020 | 2020-06-08 |
Overview of concrete fixes and attacks: RFCs and BCPs converge into OAuth 2.1 with implicit and password grants deprecated and PKCE mandatory for code flow… | ||
| “OAuth 2.1” and beyond | NDC Oslo 2020 | 2020-06-08 |
OAuth 2.1 consolidates BCPs: implicit and password grants removed, PKCE required for authorization code and redirect URIs must match exactly; public clients… | ||
| OpenID Connect & OAuth 2.0 – Security Best Practices | NDC London 2020 | 2020-01-27 |
Overview of concrete security changes and fixes for OAuth 2.0 / OpenID Connect: recommends deprecate implicit and resource owner password grants, keep only… | ||
| OpenID Connect & OAuth 2.0 – Security Best Practices | NDC Security Oslo 2020 | 2020-01-22 |
OAuth must drop risky flows: disable implicit & password grants and prefer authorization code + PKCE for all interactive clients. Require exact redirect URI… | ||
| Implementing OpenID Connect and OAuth 2.0 – Tips from the Trenches | NDC Security Oslo 2020 | 2020-01-22 |
Covers concrete implementation choices for OpenID Connect and OAuth 2.0: use the OIDC subject as the canonical user ID, distinguish public vs confidential… | ||
| Securing Web Applications and APIs with ASP.NET Core 2.2 and 3.0 | NDC Security Oslo 2019 | 2019-04-04 |
Covers ASP.NET Core security from cookie and data protection to API auth, showing that since 2.2 Microsoft includes IdentityServer4 in project templates and… | ||
| Building Clients for OpenID Connect/OAuth 2-based Systems | NDC Security Oslo 2019 | 2019-04-04 |
Recommends using client credentials for server-to-server calls and code flow with PKCE for native and browser apps, citing OAuth 2 best practices and the… | ||
| Securing Web Applications and APIs with ASP.NET Core 2.2 and 3.0 | NDC Copenhagen 2019 | 2019-03-27 |
ASP.NET Core 2.2/3.0 ships concrete security pieces: the data protection API that moves key material out of app directories and auto-rotates keys every 90… | ||
| Building Clients for OpenID Connect/OAuth 2-based Systems | NDC Copenhagen 2019 | 2019-03-27 |
Covers concrete choices and tradeoffs: recommends authorization code with PKCE for public clients, forbids no embedded login dialogs in native apps, and… | ||
| Building Clients for OpenID Connect/OAuth 2-based Systems | NDC Porto 2019 | 2019-02-26 |
Walks through concrete client patterns: use authorization header for API calls, prefer code flow with PKCE over implicit, store access tokens in secure OS… | ||
| Securing Web Applications and APIs with ASP.NET Core 2.2 and 3.0 | NDC Porto 2019 | 2019-02-26 |
Overview of concrete mechanics: shows how ASP.NET Core uses an external key store and data protection keys stored outside app with automatic key rotation (new… | ||
| Securing Web Applications and APIs with ASP.NET Core 2.2 and 3.0 | NDC London 2019 | 2019-01-30 |
ASP.NET Core 2.2/3.0 now ships templates that embed IdentityServer4 in templates and a Microsoft login UI, wiring auth, JWT validation and an API sample that… | ||
| Building Clients for OpenID Connect/OAuth 2-based Systems | NDC London 2019 | 2019-01-30 |
Overview of concrete choices for client types: server apps use client credentials and proactive or reactive token caching; native apps use browser-based login… | ||
| Authorization for Modern Applications | DevConf 2018 | 2018-09-26 |
Modern apps authenticate with OpenID Connect/OAuth2 then ask what is this user allowed to do. The solution shown is a PolicyServer reference architecture that… | ||
| Authorization for modern Applications | NDC Oslo 2018 | 2018-06-11 |
Argues a concrete architecture: keep identity (OpenID Connect/OAuth2 tokens and claims) separate from authorization and run permissions from a runtime policy… | ||
| IdentityServer for ASP.NET Core 2 | NDC London 2018 | 2018-01-15 |
IdentityServer4 adapts to ASP.NET Core 2 by replacing the old auth plumbing with dependency-injected handlers so a single middleware picks the default scheme… | ||
| Implementing Authorization in Web Applications and APIs | NDC London 2018 | 2018-01-15 |
A prototype becomes a production-ready authorization system that separates identity from permissions, arguing identity tokens must not carry app-specific… | ||
| Implementing authorization in web applications and APIs | NDC Sydney 2017 | 2017-08-14 |
Explains why authentication stays in an identity service (example: IdentityServer issuing identity tokens) while authorization lives closer to each API via a… | ||
| Implementing authorization in web applications and APIs | NDC Oslo 2017 | 2017-06-14 |
Argues that puting permissions into signed tokens fails for changing permissions and ambiguous meanings, and builds a prototype authorization provider as an… | ||
| IdentityServer4: New & Improved for ASP.NET Core | NDC Mini Copenhagen 2017 | 2017-02-22 |
Rewrites IdentityServer for ASP.NET Core, removing old Katana plumbing and reusing ASP.NET Core logging and DI, adds signing credential APIs (including a… | ||
| IdentityServer4: New & Improved for ASP.NET Core | NDC London 2017 | 2017-01-16 |
IdentityServer4 ports IdentityServer3 onto ASP.NET Core, replacing the old Katana hosting with Kestrel/self-hosted console apps and swapping the custom factory… | ||
| Building JavaScript and mobile/native Clients for Token-based Architectures | NDC London 2017 | 2017-01-16 |
Demonstrates building JavaScript and native clients that talk to IdentityServer using OpenID Connect/OAuth2, with concrete code using oidc-client.js for SPAs… | ||
| nothing matches | ||