Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
Choosing an Authorization Server: Comparing OpenIddict, Duende IdentityServer, Keycloak and Microsoft Entra ID
The right authorization server depends on what your team can operate: OpenIddict and Duende are frameworks, Keycloak a product, Entra ID a managed service. We run three in the lab, build a capability matrix from discovery documents, show why it must be read with care, and compare licenses, operational load, SAML bridging and why you should not write your own authorization server, as of November 2026.
OpenID Connect: ID Tokens, UserInfo, Discovery, AddOpenIdConnect in ASP.NET Core and Logout Types
An ID token is a sign-in record written for the client, an access token is a permission written for the API; mixing them up is a vulnerability. In a Keycloak lab we read discovery, JWKS and UserInfo, show how MapInboundClaims renames claims in AddOpenIdConnect, trace RP-initiated logout, and write a back-channel logout endpoint that drops this app's cookie when the user signs out of another app.
Authorization Code Flow + PKCE Step by Step: state, nonce, PAR and Reading the HTTP Traffic with Keycloak
PKCE binds the code that crosses the front channel to the client that asked for it; a stolen code is useless without the verifier. In a Keycloak lab we read the flow step by step with curl, show what state and nonce prevent, that a code is burned after a wrong verifier and why redirect URIs must match exactly; then we move parameters to the back channel with PAR and trace ASP.NET Core's OIDC handler end to end.
The Logic of OAuth 2.0: Roles, Grant Types, Scopes and What RFC 9700 and OAuth 2.1 Bring
OAuth 2.0 is a delegation protocol, not a sign-in protocol. We run the four roles, the front/back channel split, confidential vs public clients, and the authorization code, client credentials and device grants against a Keycloak lab with .NET 10 code; then show why implicit and password grants were removed, what RFC 9700 and the OAuth 2.1 draft bring, and why an access token is not proof of sign-in.