oauth
Articles tagged with oauth.
Authentication vs Authorization: Why Valid Logins Get 403
Authentication proves who is calling, authorization decides what they may do. See a Keycloak token pass every check and still…
18 min readOpenAM PKCE Bypass and JWKS SSRF (2026): Lessons for Keycloak OIDC Clients
OpenAM before 16.1.3 skipped PKCE on hybrid flows (CVE-2026-105119) and fetched unvalidated jwks_uri values (CVE-2026-105122). Here is the Keycloak checklist.
11 min readOAuth Redirect URI Parser Confusion: Why PKCE Does Not Save You
PKCE in OAuth does not protect an auth code sent to the wrong host. How URL parsers disagree on OAuth…
8 min readOAuth Grant Sprawl and OAuth Token Management for Admins
OAuth grant sprawl is long-lived third-party app consent that outlives the employee and the need. How OAuth token management finds,…
9 min readOAuth Scopes Explained: Standard Scopes, Design, and Scopes vs Claims
An OAuth scope is a named permission a client requests and a token carries. The standard OIDC scopes, scopes vs…
9 min readWhat Is an MCP Gateway, and What Does It Not Do for OAuth?
An MCP gateway proxies agent traffic to MCP servers and applies policy, but it does not replace token validation at…
7 min readBetter Auth 1.7.7: OAuth State vs Magic-Link Tokens
Better Auth 1.7.7 stops OAuth state values being redeemed as magic-link tokens. What went wrong, how to upgrade, and how…
11 min readKeycloak 26.8 Token Exchange Delegation for AI Agents
Keycloak 26.8 moves token exchange delegation to preview: users consent, FGAP V2 gates the agent, and the delegated token carries…
15 min readMCP Authorization Decision Tree: When to Use Keycloak
MCP authorization is optional and stdio servers should skip OAuth. A decision tree for when to use API keys, OAuth,…
8 min readNon-Human Identity (NHI) for AI Agents on Keycloak
A non-human identity is an identity used by software, not a person. How AI agents fit, why one shared bot…
10 min readStay ahead on identity & security
Get tutorials, product updates, and Keycloak tips delivered to your inbox.