OAuth 2.0 & OpenID Connect for Identity Architects
Building a working understanding of token-based auth flows to complement governance-side IGA expertise.
Where I am: working through core flows and a hands-on lab. This is a deliberate gap-filling exercise — my production depth is in governance and lifecycle (OIM), not federated authentication, and I want a working, first-hand understanding of the token-based flows that modern SSO and API access depend on.
- 1
OAuth 2.0 core flows
Authorization code, client credentials, and refresh token flows — what each is for and where they show up in enterprise SSO architectures.
OAuth 2.0 overview - 2
OpenID Connect on top of OAuth
How OIDC adds identity (ID tokens, userinfo) to OAuth's authorization model, and why the two get conflated.
OpenID Connect specification - 3
Token lifecycle and revocation
Access token expiry, refresh token rotation, and revocation — the operational governance questions that matter once tokens replace static credentials.
- 4
Lab: wire up an OIDC-based SSO flow
Hands-on: configure a test application against an OIDC provider and trace the full authorization code flow end to end.