Blog

Mert Özen's blog posts on software development, backend, frontend, and DevOps.

Series

.NET Core Web API 36 Angular 31 JavaScript Basics 19 JavaScript Intermediate 18 JavaScript Advanced 16 TypeScript Basics 14 TypeScript Intermediate 14 TypeScript Advanced 12 Entity Framework Core 28 Dapper 16 Git & GitHub 29 Web Security (OWASP Top 10) 21 LLM Fundamentals 20 C# Fundamentals 20 Object-Oriented Programming in C# 16 C# Collections and Generics 11 LINQ 17 Asynchronous Programming in C# 17 Advanced C# 14 C# Versions 6 Solution Patterns 22 SOLID and Design Principles 12 Clean Code 13 Design Patterns 23 UML and Modeling 18 Introduction to Software Architecture 9 Clean, Onion and Hexagonal Architecture 8 Vertical Slice Architecture 6 Domain-Driven Design 12 CQRS and Event Sourcing 10 Messaging and Event-Driven Architecture 9 Modular Monolith 2 Microservices 10 UI Architecture Patterns 9 Architecture Decisions 7 System Design 15 Distributed Systems Fundamentals 11 Background Jobs and Scheduled Jobs 11 Working with Message Queues 14 Logging in .NET 10 Caching 10 Real-time Applications 9 ASP.NET Core MVC and Razor Pages 13 CI/CD Fundamentals 8 GitHub Actions 16 Jenkins 12 Web Servers and Hosting 12 Deployment Strategies 9 Kubernetes 19 Authentication and Authorization 18

4 posts found #keycloak

Newest Oldest Popular

Security PART 10

The Logic of OAuth 2.0: Roles, Grant Types, Scopes and What RFC 9700 and OAuth 2.1 Bring

OAuth 2.0 is a delegation protocol, not a sign-in protocol. We run the four roles, the front/back channel split, confidential vs public clients, and the authorization code, client credentials and device grants against a Keycloak lab with .NET 10 code; then show why implicit and password grants were removed, what RFC 9700 and the OAuth 2.1 draft bring, and why an access token is not proof of sign-in.

8 Nov 2026 11 min 4

Security PART 11

Authorization Code Flow + PKCE Step by Step: state, nonce, PAR and Reading the HTTP Traffic with Keycloak

PKCE binds the code that crosses the front channel to the client that asked for it; a stolen code is useless without the verifier. In a Keycloak lab we read the flow step by step with curl, show what state and nonce prevent, that a code is burned after a wrong verifier and why redirect URIs must match exactly; then we move parameters to the back channel with PAR and trace ASP.NET Core's OIDC handler end to end.

8 Nov 2026 11 min 5

Security PART 12

OpenID Connect: ID Tokens, UserInfo, Discovery, AddOpenIdConnect in ASP.NET Core and Logout Types

An ID token is a sign-in record written for the client, an access token is a permission written for the API; mixing them up is a vulnerability. In a Keycloak lab we read discovery, JWKS and UserInfo, show how MapInboundClaims renames claims in AddOpenIdConnect, trace RP-initiated logout, and write a back-channel logout endpoint that drops this app's cookie when the user signs out of another app.

8 Nov 2026 12 min 5

Security PART 15

Choosing an Authorization Server: Comparing OpenIddict, Duende IdentityServer, Keycloak and Microsoft Entra ID

The right authorization server depends on what your team can operate: OpenIddict and Duende are frameworks, Keycloak a product, Entra ID a managed service. We run three in the lab, build a capability matrix from discovery documents, show why it must be read with care, and compare licenses, operational load, SAML bridging and why you should not write your own authorization server, as of November 2026.

8 Nov 2026 10 min 5