OAuth 2.0 is a framework with many optional and now-discouraged patterns. OAuth 2.1 consolidates a decade of security best practice into a tighter profile: PKCE is mandatory for all authorization-code flows, the implicit and password grants are removed, redirect URIs must match exactly, and bearer tokens in query strings are forbidden. Lab 10 hardens an OAuth 2.1 deployment with DPoP and PAR on top.

OAuth is an authorization framework for delegated access to APIs; it does not, by itself, tell an app who the user is. OpenID Connect is a thin identity layer on top of OAuth 2.0 that adds an ID token (a signed JWT of user claims) and a userinfo endpoint, turning OAuth into a proper single sign-on protocol. Lab 04 implements OIDC with the Authorization Code + PKCE flow.

PKCE (Proof Key for Code Exchange) stops authorization-code interception. The client generates a random code_verifier, sends its hash as a code_challenge on the authorization request, and must present the original verifier to redeem the code. An attacker who steals the code cannot exchange it without the verifier. Originally for mobile and SPA clients, PKCE is now mandatory for all clients under OAuth 2.1.

Both provide single sign-on, but SAML 2.0 is XML-based and browser-redirect oriented, common in enterprise and legacy SaaS, while OIDC is JSON/JWT-based and REST-friendly, better suited to mobile, SPAs and APIs. SAML exchanges signed assertions; OIDC exchanges signed tokens. Lab 03 builds SAML federation and Lab 04 builds OIDC so you can compare them directly.

A JWT (JSON Web Token) carries claims in three base64url parts: header, payload and signature. JWS (JSON Web Signature) is a signed-but-readable token — the default for ID and access tokens, integrity-protected but not confidential. JWE (JSON Web Encryption) is an encrypted token whose payload is hidden. Lab 09 dissects all three and shows attacks like alg:none and weak-key confusion.

SCIM 2.0 (System for Cross-domain Identity Management) is a REST standard for automatically provisioning and de-provisioning users and groups across systems. Instead of manually creating accounts in every SaaS app, an identity provider pushes joiner-mover-leaver changes over SCIM. Lab 07 automates the full lifecycle with SCIM so leavers are actually disabled everywhere.

DPoP (Demonstrating Proof of Possession) binds a token to a client-held key so a stolen bearer token cannot be replayed by anyone else — it becomes sender-constrained. PAR (Pushed Authorization Requests) sends authorization parameters to the server over a back channel first, so they cannot be tampered with in the browser. Lab 10 adds both to defend high-value APIs.

Open Policy Agent (OPA) is a general-purpose policy engine; Rego is its declarative policy language. Externalizing authorization means applications ask a central policy engine for decisions instead of hard-coding rules, so policy is testable, versioned and consistent across services. Lab 14 externalizes authorization with OPA/Rego, and Lab 13 covers the RBAC-to-ABAC shift that motivates it.