Login to Epicor Kinetic with ANY OpenID Connect Provider (On-Prem) Okta, Auth0, Entra, Facebook🤪: (Ok maybe not facebook)

[josecgomez]

oauth.net / oauth.com by Aaron Parecki are a good starting point

Nate Berbettini’s talk on OAuth in Plain English is awesome

OAuth 2.0 and OpenID Connect (in plain English)

And if you are super awesome like me you could just RAW read the RFC’s because there’s nothing more entretaining not at all boring and or dry than reading RFC’s

RFC 6749 (OAuth 2.0 core)
RFC 6750 (Bearer tokens)
RFC 7636 (PKCE)
RFC 7519 (JWT) ← This one is so cool… Non encrypted JWTs are “some how magically” still cryptographically secure… MATHS is awesome
RFC 7517 (JWK)
RFC 8414
RFC 9700

NOTE: Desperation, exhasperation and all other ations may occur upon reading these above, think of it as exposure therapy. Unrelated someone should do a dramatic reading of these it may get some traction, Audible Full Cast Edition JWT RFC? #SignMeUp

[utaylor (Utah Taylor)]

Thank you for the therapy

[jbooker (Josh Booker)]

the csp thing is surprising I thought the policy was very permissive.

[josecgomez]

Not in this case it threw down right fit

[Mark_Wonsil]

@josecgomez

Nate Berbettini’s talk on OAuth in Plain English is awesome

There are also some good NDC Talks as well, some basic, some blow past me…

ASP.NET Core Authentication and Authorization - the Key Concepts - Anders Abel - NDC Oslo 2024

BTW, Duende Software is the organization who took Identity Server (like Jose said, the basis of IdP) into a for-pay product.

Supercharging OAuth 2.0 security - Philippe De Ryck - NDC Oslo 2025

You Shall Not Password: Modern Authentication for Web Apps - Eli Holderness - NDC London 2022

How to Know Your Client Is Real: Hardware-Backed Authentication Patterns - Victor Lyuboslavsky

[utaylor (Utah Taylor)]

Thanks Mark

[chaddb (Chadd Blanchard)]

@Mark_Wonsil

Duende Software is the organization who took Identity Server (like Jose said, the basis of IdP) into a for-pay product.

Not happy about that. They also gave a big to their partners of many years. And told customers of their partners - start paying.

[Mark_Wonsil]

@chaddb

nd told customers of their partners - start paying.

Understood, but then again, working for free is a bad business model for a security firm. I agree, the way they did it sucked. Others, like Jimmy Bogard did a better job.

[chaddb (Chadd Blanchard)]

I agree free isn’t a viable long-term model. They sold to a Capital Investment company and magically, everything is now pay to play. Typical model.

[josecgomez]

@chaddb

I agree free isn’t a viable long-term model.

Now you tell me!