# oauth2 Published articles for oauth2. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Oracle urges database customers to prepare for quantum security risks DevFeed: [Oracle urges database customers to prepare for quantum security risks]() Original publisher: [Read original article]() Author: Jonathan Anthony Published: 2026-11-04T19:36:19Z Content type: news Language: en Sources: [SiliconANGLE]() Topics: [Post-quantum cryptography](), [Cryptography](), [Security](), [Oracle Database](), [Database]() Tags: [agentic](), [agentic-ai](), [agents](), [ai-agents](), [ai-data-platform](), [ai-inference](), [ai-infrastructure](), [ai-security](), [cloud-infrastructure](), [crypto-posture-assessment](), [cryptography](), [cube-event-coverage](), [data-governance](), [database](), [database-security](), [dave-vellante](), [decrypt](), [deep-data-security](), [encrypted-traffic](), [encryption](), [enterprise-ai](), [enterprise-automation](), [generative-ai](), [hybrid-cloud](), [multicloud](), [news](), [nyse-orcl](), [oauth2](), [oracle](), [oracle-ai-database-26ai](), [oracle-ai-world-2026](), [oracle-corp](), [oracle-fusion-cloud-applications](), [oracleaiworld](), [quantum](), [quantum-computers](), [quantum-security](), [risks](), [security](), [security-controls](), [security-risks](), [software-engineering](), [sovereign-cloud](), [thecube](), [vipin-samar]() ### AI overview Attackers could copy encrypted TLS traffic now and, once quantum computers are sufficiently powerful, potentially recover session keys and decrypt it, Oracle executive Vipin Samar said. Oracle Data Safe's new Cryptographic Posture Assessment checks configurations across database fleets and flags weaknesses such as TLS 1.0 or 1.1 support. Agentic AI-driven remediation is in preview. Oracle also says Deep Data Security in Oracle AI Database 26ai enforces row- and column-level access and uses signed OAuth2 tokens to identify the person behind an AI agent's query, applying controls inside the database. The excerpt describes these measures but does not provide deployment guidance or independent assessment. ### Source excerpt Attackers can copy encrypted traffic today and decrypt it once quantum computers mature, making quantum-resistant cryptography a present-day concern. Oracle Corp. is applying the philosophy behind its security controls beneath AI agents to encryption across database fleets, according to Vipin Samar (pictured), senior vice president of software engineering, database security, at Oracle. "Even though we [...] The post Oracle urges database customers to prepare for quantum security risks appeared first on SiliconANGLE. ## October product update: Passkeys, MCP and more DevFeed: [October product update: Passkeys, MCP and more]() Original publisher: [Read original article]() Author: Aishwari Pahwa Published: 2026-11-04T00:00:00Z Content type: release Language: en Sources: [Appwrite Blog]() Topics: [Appwrite](), [Passkeys](), [Release notes](), [MSP MCP](), [Helm charts](), [CI/CD]() Tags: [email](), [events](), [functions](), [geo](), [helm](), [mcp](), [oauth2](), [passkeys](), [product-update](), [products](), [providers]() ### AI overview Appwrite's October 2026 update adds passwordless passkey sign-in across web and mobile, six OAuth2 providers, and single-use email verification and recovery codes that expire after 15 minutes. Functions gain inbound email triggers on Appwrite Cloud and interval scheduling alongside cron. MCP Events let compatible agents receive project-change notifications through streaming or signed webhooks. The update also adds Entire Git deployments on Cloud and an official Kubernetes Helm chart for self-hosting. Other changes include Premium Geo DB, a binary cache format with benchmarked reductions in memory use and improved cached-list throughput, and Android SDK R8 full-mode support. From November 5, inactive Cloud Sites and Functions deployments default to cleanup after 30 days; active and custom-domain deployments are retained, and longer history can be configured subject to plan limits. ### Source excerpt See what's new in Appwrite with passkeys, new OAuth2 providers, email triggers for Functions, MCP Events, a Helm chart, Premium Geo DB, and more. ## Identity and Access Management Architecture DevFeed: [Identity and Access Management Architecture]() Original publisher: [Read original article]() Author: Scaibu Published: 2026-10-27T10:20:02Z Content type: article Language: en Sources: [DevOps.dev]() Topics: [Keycloak](), [identity and access management](), [Secure token management](), [Authorization](), [Access Control](), [OpenID connect (OIDC)](), [Single sign-on (SSO)](), [sessions](), [saml](), [WebAuthn](), [Secrets Management](), [passwords]() Tags: [2026](), [access-management](), [ami](), [architecture](), [authentication](), [authorization](), [broker](), [cncf](), [identity](), [identity-and-access](), [identity-and-access-management](), [jwt](), [keycloak](), [ldap](), [login](), [lts](), [minors](), [oauth2](), [october-2026](), [open-source](), [password](), [quarkus](), [software-architecture](), [system-design-interview]() ### AI overview Keycloak centralizes login, federation and token issuance, while applications validate signed JWTs locally and retain fine-grained authorization such as tenant roles, API keys and resource permissions. The excerpt recommends coarse roles and identity claims in short-lived tokens, with per-request tenant membership checks and ReBAC in the application. It describes an integration that gets PKCE and five-minute access tokens right but has critical gaps: its JWT verifier decodes tokens without checking signatures, and sign-in and administration still use the legacy password grant. The target design uses Authorization Code with PKCE for people, client credentials for services, device authorization for CLIs, and cached JWKS validation checking signature, issuer, audience and expiry. Keycloak is presented as feature-rich for self-hosted federation and security controls, but requires operating a stateful Java service and keeping pace with quarterly upgrades; it does not replace application-level authorization. ### Source excerpt A Practical Guide to Authentication, Authorization, Single Sign-On, and Identity FederationWhat Keycloak is? Keycloak is an open-source identity broker and authorization server: it logs users in, issues standards-based tokens, and federates identities from other systems so your services never handle passwords. The current release is 26.8.1, shipped 13 October 2026 (versio.io). It solves three problems at once. Applications delegate login to one place (SSO). Users can come from local accounts, LDAP/AD, or upstream IdPs such as Google or a corporate SAML IdP (brokering and federation). Services verify a signed JWT locally instead of calling a session store on every request. Key facts that shape how you operate it: Lineage. Red Hat has stewarded it since 2018 and ships it commercially as Red Hat build of Keycloak; it is a CNCF incubating project. Runtime. Since version 17 it runs on Quarkus, not WildFly. Old guides using standalone.xml, /auth context paths or jboss-cli are obsolete. No LTS. The community project patches only the latest minor; older lines stop getting security fixes when a new one ships (Skycloak). Minors land roughly quarterly (26.5 Jan, 26.6 Apr, 26.7 Jul, 26.8 Oct 2026), so plan an upgrade cadence, not an install. Admin bootstrap changed. KEYCLOAK_ADMIN / KEYCLOAK_ADMIN_PASSWORD were replaced by KC_BOOTSTRAP_ADMIN_USERNAME / KC_BOOTSTRAP_ADMIN_PASSWORD, which seed a temporary first admin only Core domain model Everything in Keycloak lives inside a realm, a fully isolated namespace with its own users, clients, keys and login policies. The master realm is for administering Keycloak only; never put application users there. Realm. Isolation boundary for users, keys, sessions and flows. Use one realm per trust domain, not per customer; hundreds of realms degrade startup and the admin UX. Client. An application that asks Keycloak to authenticate users or itself. Public clients (SPA, mobile) hold no secret; confidential clients (backends) hold a secret or k ## Announcing six new OAuth2 login providers in Appwrite Auth DevFeed: [Announcing six new OAuth2 login providers in Appwrite Auth]() Original publisher: [Read original article]() Author: Aditya Oberai Published: 2026-10-19T00:00:00Z Content type: release Language: en Sources: [Appwrite Blog]() Topics: [Why Rely on a Social Auth Library?](), [Appwrite](), [Server-side vs Client-side OAuth2 Flows](), [Back end](), [hugging face](), [webflow]() Tags: [2](), [3](), [about](), [access-tokens](), [account](), [added](), [admin](), [ai](), [ai-developers](), [announcements](), [app](), [auth](), [cloudflare](), [hugging-face](), [login](), [oauth2](), [providers](), [server](), [tiktok](), [webflow](), [with]() ### AI overview Appwrite Auth adds six OAuth2 providers--Hugging Face, Resend, Cloudflare, TikTok, Kakao, and Webflow--using the existing login APIs. Enable each provider in the Console with its client credentials; server apps can use createOAuth2Token and createSession, while browser apps use createOAuth2Session. Appwrite handles PKCE for Resend and Cloudflare, and provider access tokens are available for supported API access. Provider data differs: TikTok and Resend provide no email; Cloudflare and Webflow emails are unverified; Hugging Face and Kakao emails are marked verified only when the provider confirms them. Unverified email matches do not automatically sign into existing accounts; users can link identities after signing in. Resend requires an explicit scope, and Kakao scopes must be enabled as consent items or authorization can fail with KOE205. All six are on Appwrite Cloud; self-hosted availability spans versions 2.0 through 2.4. ### Source excerpt Appwrite Auth now supports OAuth2 login with Hugging Face, Resend, Cloudflare, TikTok, Kakao, and Webflow. See what each returns and how to add it to a server-side app. ## SAP warns of maximum severity OAuth2 SSRF security flaw DevFeed: [SAP warns of maximum severity OAuth2 SSRF security flaw]() Original publisher: [Read original article]() Author: Sergiu Gatlan Published: 2026-10-13T13:51:02Z Content type: news Language: en Sources: [BleepingComputer]() Topics: [Security](), [SSL](), [ABAP](), [snyk]() Tags: [computer-help](), [computer-security](), [computers](), [dos](), [fixed](), [infosec](), [infosec-computer-security](), [linux](), [mac](), [malware](), [malware-removal](), [oauth](), [oauth2](), [python](), [sap](), [security](), [security-updates](), [server-side-request-forgery](), [spyware](), [ssrf](), [support](), [tech-support](), [technical-support](), [virus](), [virus-removal](), [vulnerability](), [windows]() ### AI overview SAP's October 2026 security updates address 20 flaws, including a maximum-severity OAuth2 SSRF vulnerability in the Cloud SDK for Python. An attacker controlling the tenant_subdomain parameter could redirect OAuth2 token requests to steal client credentials. Customers unable to patch immediately can validate the parameter against an allowlist of registered tenant subdomains as a temporary mitigation. ### Source excerpt SAP has addressed 20 security flaws across multiple products in its October 2026 security updates, including a maximum-severity vulnerability in the Cloud SDK for Python. [...] ## Migrating from NGINX Ingress to ALB: Handling oauth2-proxy DevFeed: [Migrating from NGINX Ingress to ALB: Handling oauth2-proxy]() Original publisher: [Read original article]() Author: Ali Sanhaji Published: 2026-10-06T15:54:29Z Content type: tutorial Language: en Sources: [Containers]() Topics: [ingress-nginx](), [nginx](), [OpenID connect (OIDC)](), [Load Balancing]() Tags: [advanced-300](), [amazon-elastic-kubernetes-service](), [backend](), [elastic-load-balancing](), [load-balancer](), [nginx-ingress-controller](), [oauth2](), [oidc](), [technical-how-to]() ### AI overview The article explains how teams migrating from NGINX Ingress to the AWS Load Balancer Controller can preserve OpenID Connect authentication when using oauth2-proxy. It compares keeping oauth2-proxy in reverse proxy mode with using ALB native OIDC, highlighting differences in backend authorization headers and outlining a staged migration and validation process. ### Source excerpt The NGINX Ingress Controller is retired. If you run oauth2-proxy with NGINX for OpenID Connect authentication, switching to the AWS Load Balancer Controller can silently break your auth. This post shows two ways to keep OIDC working on an Application Load Balancer: run oauth2-proxy in reverse proxy mode, or use ALB native OIDC. ## Gitea 28.0.0 is released DevFeed: [Gitea 28.0.0 is released]() Original publisher: [Read original article]() Author: bircni, TheFox0x7 Published: 2026-09-30T08:00:00Z Content type: release Language: en Sources: [Gitea Blog]() Topics: [Gitea]() Tags: [announce](), [changelog](), [deploy](), [docker](), [git](), [gitea](), [oauth2](), [release]() ### AI overview Gitea v28.0.0 removes the historical "1." version prefix and adds audit logging, bot accounts, HTTPS deploy tokens, administrator impersonation, code-owner approval rules, diff file filters, and an Actions queue view. The release also changes Git network operations to use an internal proxy with egress settings, introduces breaking changes to egress rules, and makes completed Actions runs expire after 400 days. ### Source excerpt We are thrilled to announce the latest release of Gitea **v28.0.0**. Gitea drops the historical `1.` prefix from its version numbers, so this release is **28.0.0** rather than 1.28.0. Highlights include audit logging, bot accounts, HTTPS deploy tokens, user impersonation for administrators, code-owner approval rules, diff file filters, and an Actions queue view. See the [changelog](#changelog) for everything else. We are very thankful for the many people who have contributed to the project by sending code patches, reporting issues, translating, and supporting us in many other ways. ## Appwrite Avatars adds profile photos with OAuth2, Gravatar, Libravatar, and fallback rendering DevFeed: [Appwrite Avatars adds profile photos with OAuth2, Gravatar, Libravatar, and fallback rendering]() Original publisher: [Read original article]() Author: Aditya Oberai Published: 2026-09-25T00:00:00Z Content type: release Language: en Sources: [Appwrite Blog]() Topics: [Appwrite](), [OAuth 2.0](), [API](), [Image]() Tags: [announcements](), [api](), [app](), [gravatar](), [image](), [oauth2](), [sha-256]() ### AI overview Appwrite Avatars now provides a single getPhoto call that resolves profile images from OAuth2 identities, Gravatar, Libravatar, initials, or a placeholder. ### Source excerpt Appwrite Avatars now returns a profile photo for any user with one getPhoto call, resolving OAuth2 photos, Gravatar, Libravatar, and initials in order. ## Announcing native sign-in: Create Appwrite sessions from Apple and Google ID tokens DevFeed: [Announcing native sign-in: Create Appwrite sessions from Apple and Google ID tokens]() Original publisher: [Read original article]() Author: Atharva Deosthale Published: 2026-09-24T00:00:00Z Content type: release Language: en Sources: [Appwrite Blog]() Topics: [Appwrite](), [Mobile](), [OAuth 2.0](), [openid](), [sessions](), [account]() Tags: [account](), [announcements](), [apple](), [google](), [id](), [mobile](), [oauth](), [oauth2](), [openid](), [sessions](), [sign-in]() ### AI overview Appwrite Auth now accepts OpenID Connect ID tokens from Apple or Google and creates an Appwrite session in a single request. The release explains native sign-in configuration, token validation, account matching, and the distinct Google OAuth client IDs required for mobile apps and Appwrite. ### Source excerpt Your mobile app can now use the platform's own Sign in with Apple or Google account picker and exchange the ID token for an Appwrite session in one request, with no redirect through Appwrite. ## Four ways MCP authorization breaks in production DevFeed: [Four ways MCP authorization breaks in production]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-23T00:00:00Z Content type: article Language: en Sources: [WorkOS]() Topics: [Model Context Protocol](), [Authorization](), [litellm](), [OAuth 2.0](), [Vulnerabilities](), [Authentication]() Tags: [authentication-bypass](), [authorization](), [cve](), [cvss](), [kev](), [litellm](), [mcp](), [oauth2]() ### AI overview This article examines four recurring ways MCP authorization fails in production. It uses a LiteLLM MCP endpoint vulnerability as an example of authentication degrading to an open state, and discusses specification requirements for token validation, OAuth2 passthrough, RFC 8707, and PKCE. ### Source excerpt The 2026-07-28 spec tells you exactly what to do. These are the code shapes that ignore it. ## AI agent credentials: Four architectures compared DevFeed: [AI agent credentials: Four architectures compared]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-21T00:00:00Z Content type: comparison Language: en Sources: [WorkOS]() Topics: [AI Agent](), [Claude](), [Google](), [Nvidia](), [OpenShell](), [proxy](), [Language models](), [Network](), [OAuth 2.0](), [Model Context Protocol]() Tags: [agent](), [agent-infrastructure](), [ai](), [ai-agent](), [architectures](), [credentials](), [google](), [mcp](), [network](), [nvidia](), [oauth2](), [production](), [proxy](), [secrets]() ### AI overview A comparison of four approaches to securing credentials for production AI agents. Google and NVIDIA keep secrets outside the sandbox, Rubrik issues tokens per tool call, Microsoft inspects MCP traffic, and Opal delegates request enforcement. The article focuses on which failures each architecture prevents and the gaps that remain. ### Source excerpt Google, NVIDIA, Rubrik, Microsoft and Opal each solve agent credentials differently. What each one protects against, and the gap they share. ## Appwrite Init 2026 recap: Everything we shipped DevFeed: [Appwrite Init 2026 recap: Everything we shipped]() Original publisher: [Read original article]() Author: Aishwari Pahwa Published: 2026-09-15T00:00:00Z Content type: release Language: en Sources: [Appwrite Blog]() Topics: [Appwrite](), [releases](), [PostgreSQL](), [Amazon S3](), [Firewall](), [OAuth 2.0](), [Self-hosted]() Tags: [2](), [firewall](), [init](), [oauth2](), [postgresql](), [recap](), [release](), [releases](), [s3](), [self-hosted]() ### AI overview An Appwrite Init 2026 recap covering five days of launches, including Appwrite 2.0, a redesigned Console, native PostgreSQL, VectorsDB, DocumentsDB, MySQL, S3-compatible Storage, Firewall, OAuth2, and Domains. ### Source excerpt An Appwrite Init 2026 recap of all five days of launches, from Appwrite 2.0 and native PostgreSQL to VectorsDB, S3 support, Firewall, OAuth2, and Domains. ## Turn your app into an MCP server with the Appwrite OAuth2 server DevFeed: [Turn your app into an MCP server with the Appwrite OAuth2 server]() Original publisher: [Read original article]() Author: Atharva Deosthale Published: 2026-09-04T00:00:00Z Content type: tutorial Language: en Sources: [Appwrite Blog]() Topics: [Appwrite](), [Model Context Protocol](), [OAuth 2.0](), [Authorization](), [Claude Code](), [Serverless](), [Web app](), [Database]() Tags: [ai](), [ai-tools](), [app](), [auth](), [authorization](), [browser](), [claude](), [claude-code](), [code](), [databases](), [http](), [mcp](), [mcp-server](), [oauth2](), [remote-mcp-server](), [serverless](), [tutorial](), [tutorials](), [web](), [web-app]() ### AI overview This tutorial explains how to turn an Appwrite-based application into a remote MCP server. It uses an Appwrite Function, the OAuth2 server included in an Appwrite project, and a consent screen so AI tools such as Claude Code can access and act on behalf of signed-in users. ### Source excerpt Build a remote MCP server for your product, host it on Appwrite Functions, and let AI tools like Claude Code sign in through the OAuth2 server built into your Appwrite project. ## Build a memory MCP server on Appwrite DevFeed: [Build a memory MCP server on Appwrite]() Original publisher: [Read original article]() Author: Atharva Deosthale Published: 2026-09-04T00:00:00Z Content type: tutorial Language: en Sources: [Appwrite Blog]() Topics: [Appwrite](), [Model Context Protocol](), [OAuth 2.0](), [Serverless](), [Database](), [Embeddings](), [Claude Code](), [Web app]() Tags: [ai](), [ai-assistants](), [ai-tools](), [api](), [claude](), [claude-code](), [embeddings](), [mcp](), [mcp-server](), [memory](), [net](), [oauth2](), [sdk](), [serverless](), [tutorial](), [tutorials]() ### AI overview This tutorial builds Recall, a small persistent-memory app on Appwrite. It hosts a stateless remote MCP server in an Appwrite Function, stores embedded memories in VectorsDB for similarity search, and uses OAuth2 for user-authorized access. It also explains connecting Claude Code to the server. ### Source excerpt Give your AI tools a shared, persistent memory. Host a stateless MCP server on Appwrite Functions, store memories in VectorsDB, and protect it with your project's OAuth2 server. ## Announcing the Appwrite OAuth2 server: Turn your project into an identity provider DevFeed: [Announcing the Appwrite OAuth2 server: Turn your project into an identity provider]() Original publisher: [Read original article]() Author: Matej Bačo Published: 2026-09-04T00:00:00Z Content type: release Language: en Sources: [Appwrite Blog]() Topics: [Appwrite](), [OAuth 2.0](), [OpenID connect (OIDC)](), [Authorization](), [API](), [internal developer portal]() Tags: [announcements](), [api](), [authorization](), [developer-portal](), [github](), [oauth](), [oauth2](), [oidc](), [openid-connect](), [product](), [sdks]() ### AI overview Appwrite announces an OAuth2 server that lets projects act as OAuth 2.1 and OpenID Connect providers. Other applications can register as clients, obtain user-approved scoped access to APIs, and use standard authorization and token flows. ### Source excerpt Your Appwrite project can now act as an OAuth 2.1 and OpenID Connect provider, so other apps can offer Sign in with your product and request scoped access to your APIs. ## Add extra security to your SPA with DPoP and FusionAuth DevFeed: [Add extra security to your SPA with DPoP and FusionAuth]() Original publisher: [Read original article]() Author: Bryan Robinson Published: 2026-09-04T00:00:00Z Content type: tutorial Language: en Sources: [FusionAuth]() Topics: [Single-page application (SPA)](), [Security](), [OAuth 2.0](), [Cryptography]() Tags: [oauth2](), [security](), [single-page-application](), [tutorial]() ### AI overview The article explains how DPoP sender-constrains OAuth 2.0 tokens in single-page applications. It describes generating a client key pair, signing proofs for requests, and verifying that the proof matches the access token to reduce token replay risk. ### Source excerpt To further protect users of your single-page application, sender-constrain your tokens with DPoP and FusionAuth's JS SDKs. ## Announcing Appwrite Apps: Create apps that build on your users' Appwrite projects DevFeed: [Announcing Appwrite Apps: Create apps that build on your users' Appwrite projects]() Original publisher: [Read original article]() Author: Atharva Deosthale Published: 2026-09-04T00:00:00Z Content type: release Language: en Sources: [Appwrite Blog]() Topics: [Appwrite](), [OAuth](), [OAuth 2.0](), [API keys](), [Authorization](), [API](), [migration]() Tags: [announcements](), [api-keys](), [apis](), [authorization](), [developers](), [documentation](), [oauth](), [oauth2](), [product]() ### AI overview Appwrite announces Appwrite Apps, allowing organizations to register applications that serve other Appwrite developers. The feature uses OAuth 2.1 and OpenID Connect for consent-based, scoped access to selected projects and organizations instead of pasted API keys. ### Source excerpt Register an app in your organization and build dashboards, deployment tools, CLIs, and agents for other Appwrite developers, with consent-based, scoped tokens instead of pasted API keys. ## How to add Sign in with Appwrite to your app DevFeed: [How to add Sign in with Appwrite to your app]() Original publisher: [Read original article]() Author: Matej Bačo Published: 2026-09-04T00:00:00Z Content type: tutorial Language: en Sources: [Appwrite Blog]() Topics: [Appwrite](), [Single sign-on (SSO)]() Tags: [account](), [adapter](), [adapters](), [app](), [apple](), [apps](), [auth](), [authentication](), [authorization](), [based](), [best](), [flow](), [oauth2](), [set](), [sign](), [sign-in](), [tutorials](), [up](), [users](), [with](), [works]() ### AI overview Appwrite's built-in OAuth2 provider lets users authenticate to an app with their Appwrite account: they approve a consent screen, then return with an active session. The flow uses an SDK redirect, an authorization code exchanged for tokens server-side, and a PKCE verifier with an S256 challenge. To begin setup, enable the Appwrite provider under Auth > Social providers in the Appwrite Console; its Quick setup can handle client registration with Appwrite itself. The excerpt ends while describing that setup, so it does not show the remaining configuration steps. ### Source excerpt Let users log in with their Appwrite account using the built-in OAuth2 provider. Learn how the flow works and how to set it up end to end. ## Meet the Symfony Core Team at the API Platform Conference 2026! DevFeed: [Meet the Symfony Core Team at the API Platform Conference 2026!]() Original publisher: [Read original article]() Author: Cécile HAMEREL Published: 2026-09-02T14:30:00Z Content type: news Language: en Sources: [Symfony]() Topics: [API](), [Symfony](), [PHP](), [migration](), [Domain-driven design (DDD)](), [JSON Web Tokens](), [OAuth 2.0](), [OpenID connect (OIDC)](), [Model Context Protocol]() Tags: [2026](), [ai-agents](), [api-platform](), [conference](), [event](), [mcp](), [migration](), [oauth2](), [oidc](), [php](), [symfony]() ### AI overview The API Platform Conference 2026 will take place in Lille, France, on September 17-18. The event will feature nearly 30 talks, including sessions by Symfony Core Team members on migration, API security, DDD, HTTP headers, FrankenPHP, AI agents, and MCP. ### Source excerpt The API Platform Conference, the international event dedicated to the API Platform framework and its ecosystem, will take place in two weeks in Lille, France, on September 17-18, 2026. Nearly 30 talks are scheduled, in both French and English, covering... ## Single Sign-On for the Debezium Platform DevFeed: [Single Sign-On for the Debezium Platform]() Original publisher: [Read original article]() Author: Philippe Camus Published: 2026-08-27T00:00:00Z Content type: tutorial Language: en Sources: [Debezium]() Topics: [Single sign-on (SSO)](), [identity and access management](), [Keycloak](), [Kubernetes](), [Entra ID](), [OpenID connect (OIDC)](), [OAuth 2.0](), [Deployment](), [proxy](), [rbac](), [Quarkus]() Tags: [2fa](), [api](), [debezium](), [entra-id](), [identity-and-access-management](), [keycloak](), [kubernetes](), [oauth2](), [openid-connect](), [proxy](), [quarkus]() ### AI overview A tutorial on placing the Debezium Platform behind single sign-on on Kubernetes using Keycloak as the identity provider. It explains how OAuth2 Proxy, OpenID Connect, and external corporate directories such as Microsoft Entra ID can support login and authorization workflows. ### Source excerpt Identity and Access Management is a highly anticipated feature for the Debezium Platform, slatted for Q4. Until then, we can explore what is currently possible: Single Sign-on, OpenID Connect, and even brokering Entra ID. In this first post, I will walk you through putting a Debezium Platform deployment on Kubernetes behind a single sign-on (SSO) login with Keycloak as an Identity Provider. The scenario throughout the blog series is Contoso Retail, a fictional company on the domain contoso.com, running the Platform on a Kubernetes cluster and wanting its own staff list to govern access to it. Contoso Retail uses Entra ID as its corporate directory. Read more... ## /.well-known/oauth-authorization-server DevFeed: [/.well-known/oauth-authorization-server]() Original publisher: [Read original article]() Author: Joost de Valk Published: 2026-07-08T00:00:00Z Content type: tutorial Language: en Sources: [The Website Specification]() Topics: [OAuth 2.0](), [OAuth](), [OpenID connect (OIDC)](), [Authorization]() Tags: [authentication](), [authorization](), [discovery](), [jq](), [json](), [jwks](), [oauth](), [oauth-2-0](), [oauth2](), [oidc](), [openid](), [openid-connect](), [optional](), [rfc](), [scopes](), [server](), [servers](), [signing](), [well-known]() ### AI overview Explains the OAuth 2.0 authorization server metadata document defined by RFC 8414, how it differs from OpenID Connect Discovery, and when servers should publish it. It covers required endpoints, URL construction for path-based issuers, implementation details, common mistakes, and a curl and jq verification example. ### Source excerpt A JSON metadata document describing a plain OAuth 2.0 authorisation server's endpoints and capabilities. The non-OIDC sibling of openid-configuration; only needed if you run an authorisation server. ## Gitea 1.26.3 and 1.26.4 are released DevFeed: [Gitea 1.26.3 and 1.26.4 are released]() Original publisher: [Read original article]() Author: bircni Published: 2026-06-21T08:00:00Z Content type: release Language: en Sources: [Gitea Blog]() Topics: [Gitea](), [Security](), [upgrade](), [Docker](), [Repository](), [bug](), [OAuth 2.0](), [proxy]() Tags: [bug](), [docker](), [gitea](), [oauth2](), [proxy](), [repository](), [security](), [upgrade]() ### AI overview Gitea 1.26.3 and 1.26.4 deliver security fixes, bug fixes, and stability improvements. Version 1.26.4 fixes a repository code-page regression introduced in 1.26.3 and adds a security fix; the release recommends upgrading directly to 1.26.4. ### Source excerpt We are excited to announce the release of **Gitea 1.26.3** and **Gitea 1.26.4**. Version 1.26.3 delivers a large set of security fixes alongside important bug fixes and stability improvements. Version 1.26.4 follows immediately with a fix for a repository code-page regression introduced in 1.26.3 and an additional security fix. **We strongly recommend upgrading directly to 1.26.4.** If you are already on 1.26.3, please upgrade to 1.26.4 as soon as possible. ## 1.26.4 This release fixes the **"context deadline exceeded"** regression from 1.26.3, where repository code pages could fail to load ([#38177](https://github.com/go-gitea/gitea/issues/38177)). `WalkGitLog` now handles EOF and context errors correctly ([#38185](https://github.com/go-gitea/gitea/pull/38185)). Thanks to @wxiaoguang for the fix. It also addresses the following security advisory: * Do not auto-reactivate disabled users on the OAuth2 sign-in callback ([#38183](https://github.com/go-gitea/gitea/pull/38183)). Thanks to @chndlrx for the report, and @bircni for the fix. This release includes [2 merged pull requests](https://github.com/go-gitea/gitea/pulls?q=is%3Apr+milestone%3A1.26.4+is%3Amerged) in the milestone. Special thanks to @wxiaoguang for the quick hotfix. ## 1.26.3 This release addresses a number of security advisories. Several of them bundle multiple fixes into combined pull requests ([#38151](https://github.com/go-gitea/gitea/pull/38151) and [#38147](https://github.com/go-gitea/gitea/pull/38147)). * CVE-2026-20896: The Docker images shipped a `REVERSE_PROXY_TRUSTED_PROXIES = *` default, which let any source IP impersonate any user via the `X-WEBAUTH-USER` header. Reverse-proxy authentication is now opt-in and admin-configured ([#38151](https://github.com/go-gitea/gitea/pull/38151)). Thanks to Joshua Martinelle with Tenable / bughunters@tenable and @rz1027 for the report, and @bircni for the fix. * CVE-2026-22874: Tighten the default allow-list filter used by webhooks and migrations to close ## Announcing Keycloak's Identity Summit: KEYCONF26 DevFeed: [Announcing Keycloak's Identity Summit: KEYCONF26]() Original publisher: [Read original article]() Author: Nathalia Pinesi, Alexander Schwartz Published: 2026-05-02T00:00:00Z Content type: article Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [identity and access management](), [OAuth 2.0](), [OpenID connect (OIDC)](), [Single sign-on (SSO)](), [Kubernetes](), [Security]() Tags: [2026](), [conference](), [identity](), [identity-and-access-management](), [idm](), [implementation](), [kerberos](), [keycloak](), [kubernetes](), [ldap](), [oauth2](), [oidc](), [openid-connect](), [saml](), [security](), [sso](), [summit]() ### AI overview Keycloak announces KEYCONF26, its annual Identity Summit for the Keycloak user community, taking place in Prague on October 8, 2026. The event will feature interactive sessions, practical discussions, networking, and a call for speakers and sponsors. ### Source excerpt Our annual conference dedicated to the Keycloak user community returns, with even more content and networking opportunities than last year. It's the perfect place to interact, learn, share, and exchange insights and real-world use cases, network with fellow experts, users, and contributors. 📍 Introducing KEYCONF26 - taking place in Prague on October 8th, 2026! This year's edition of the Keycloak Identity Summit features interactive sessions, and even more opportunities to engage with the people shaping the future of identity and access management. Call for sessions The call for sessions is open until May 24th, 2026 -- we'd love to hear from you! We're looking for sessions on topics such as: Keycloak deployment and operations at scale Human and non-human identities in the world of AI OAuth2, OIDC, and evolving identity standards Security best practices and hardening EU Digital Identity Wallets and eIDAS Migration stories and real-world use cases Extending and customizing Keycloak Submit your proposal now! What to expect at KEYCONF26 Inspiring Keynote Speaker Hear from Hannah Short, Team Lead for Identity and Access Management at CERN, how they are using Keycloak as a highly performant and reliable SSO running on Kubernetes. Connect with like-minded professionals From long-time contributors to those just starting their IAM journey, KEYCONF26 is the perfect place to meet others working with identity, OAuth2, OIDC, and more. Networking lunch Our extended lunch break is designed to help you meet fellow attendees, swap ideas, and build meaningful professional connections in a relaxed setting. Business drinks Stick around after the last session for informal networking over drinks. Want to sponsor this year's Business Drink? Get in touch with us--we'd love to partner with you! Expert sessions and real-world use cases Gain practical insights into Keycloak implementation, security improvements, OAuth2 best practices, and evolving identity standards. Learn how to use EU Digital ## Resetting Mutt's terminal after OAuth2 / GPG DevFeed: [Resetting Mutt's terminal after OAuth2 / GPG]() Original publisher: [Read original article]() Published: 2026-04-01T01:23:28Z Content type: tutorial Language: en Sources: [Signs of Triviality]() Topics: [OAuth 2.0](), [Terminal]() Tags: [flow](), [how-to](), [oauth2](), [terminal]() ### AI overview A quick fix for resetting Mutt's terminal after shelling out to GPG during an OAuth2 flow. ### Source excerpt A quick fix for how to get mutt's terminal reset after shelling out to GPG during the OAuth2 flow. [Next page]()