---
title: "OpenID Connect"
description: "13 posts about OpenID Connect, summarised, each linking to the original."
---

# OpenID Connect
> 13 posts about OpenID Connect, summarised, each linking to the original.

## Articles

### [Introducing JWT authentication in ClickHouse Cloud](https://yomu.fyi/post/introducing-jwt-authentication-in-clickhouse-cloud.md)
- Company: [Clickhouse](https://yomu.fyi/company/clickhouse.md)
- Published: Oct 8, 2026
- Type: Announcement

ClickHouse Cloud now supports JWT authentication for services running version 26.4 or later, allowing short-lived tokens from OpenID Connect providers such as Okta and Microsoft Entra to replace long-lived passwords. When a client presents a token, ClickHouse verifies its signature and claims, then creates an ephemeral in-memory user with the roles and grants specified in the token. The user disappears after the token’s expiration, removing the need for CREATE USER or DROP USER commands. Roles are managed once in ClickHouse and assigned via token claims; identity and group membership are governed by the provider. The feature also handles definer views by writing persistent shadow users, and it supports RS256 keys from version 26.4 and EC keys from version 26.8.


### [Ktor 3.6.0 Is Now Available!](https://yomu.fyi/post/ktor-3-6-0-is-now-available.md)
- Company: [Jetbrains](https://yomu.fyi/company/jetbrains.md)
- Author: Simon Vergauwen
- Published: Sep 18, 2026
- Type: Announcement

Ktor 3.6.0 introduces experimental typed authentication with full type safety, including role-based access and anonymous users, plus a dedicated OpenID Connect plugin that supports sessions and auto-refreshing tokens, and experimental HTTP/3 support for the Netty engine via QUIC. Request-parameter conversion now supports Kotlin’s Uuid, Byte, and unsigned numeric types, while receive() accepts nullable types, deprecating receiveNullable(), and more flexible routing syntax. The ContentNegotiation plugin gains a ContentTypeMergeStrategy.SkipIfPresent to preserve explicit Accept headers. Kotlin Multiplatform projects benefit from the ktor-client-engine-defaults artifact and file-based HttpCache storage using kotlinx-io Path, simplifying cross-platform configuration. Additional improvements include respondHtmlPartial for partial HTML output, asynchronous DNS resolution for the CIO engine, and WebRTC support for JVM.


### [Make Secure App-to-App Connections Using Cross App Access](https://yomu.fyi/post/make-secure-app-to-app-connections-using-cross-app-access.md)
- Company: [Okta](https://yomu.fyi/company/okta.md)
- Author: Alisa Duncan
- Published: Feb 10, 2026
- Type: Tutorial

Enterprise app-to-app integrations can create governance, security, and consent problems when API keys lack user context and standard OAuth leaves connection approval to individuals. The tutorial adds Cross App Access (XAA), an OAuth extension based on the Identity Assertion Authorization Grant, to a NestJS note-taking app and connects it to a to-do app through xaa.dev. It uses TypeScript, openid-client, and the testing site’s IdP, with two token exchanges: an ID token becomes an ID-JAG token, then a JWT-bearer grant exchanges that assertion at the resource authorization server for an access token. After authentication, the completed flow calls the to-do API and exposes each handshake step and response in console logs.


### [Stretch Your Imagination and Build a Delightful Sign-In Experience](https://yomu.fyi/post/stretch-your-imagination-and-build-a-delightful-sign-in-experience.md)
- Company: [Okta](https://yomu.fyi/company/okta.md)
- Author: Alisa Duncan
- Published: Nov 12, 2025
- Type: Tutorial

This tutorial shows how to customize the Okta-hosted Sign-In Widget (SIW) for a fictional to-do application while retaining Okta Identity Engine authentication flows. It covers configuring a custom domain and enabling SIW Gen3, then using brand settings, design tokens, custom CSS properties, and page code to change fonts, colors, layout, and background treatment. The implementation uses the widget’s afterTransform method and FormBag to revise the identify form, remove help, unlock, and divider elements, change the title, and add a custom blog link. It also explains the default HTML and JavaScript rendering configuration and describes updating an OpenID Connect application to use the brand’s custom sign-in URL as its issuer.


### [Secure Your Express App with OAuth 2.0, OIDC, and PKCE](https://yomu.fyi/post/secure-your-express-app-with-oauth-2-0-oidc-and-pkce.md)
- Company: [Okta](https://yomu.fyi/company/okta.md)
- Author: Akanksha Bhasin
- Published: Jul 28, 2025
- Type: Tutorial

Building authentication from scratch is risky and time-consuming, so the tutorial integrates Okta with an Express application using Passport, openid-client, OAuth 2.0, and OpenID Connect (OIDC). It creates a role-based expense dashboard in which users view spending data for their assigned teams, with team membership mapped from the email claim in the ID token. The setup uses Authorization Code Flow with PKCE, defined in RFC 7636, alongside express-session, EJS views, environment variables, and Okta redirect URI configuration. The sample project includes routes for login, logout, dashboard, profile, and team-specific expenses, while the running app displays these authenticated views. It concludes that OIDC supplies the identity layer over OAuth 2.0 and presents PKCE as a security baseline for server-side and browser-based web applications.


### [Secure OAuth 2.0 Access Tokens with Proofs of Possession](https://yomu.fyi/post/secure-oauth-2-0-access-tokens-with-proofs-of-possession.md)
- Company: [Okta](https://yomu.fyi/company/okta.md)
- Author: Alisa Duncan
- Published: Sep 10, 2024
- Type: Tutorial

Bearer access tokens grant whoever possesses them access, making theft especially risky for public clients such as SPAs and mobile apps. DPoP, an OAuth 2.0 extension, binds a token to a client’s public key and uses signed proofs so authorization and resource servers can verify requests. The tutorial migrates an Angular single-page application from bearer tokens to DPoP while building on the Authorization Code flow, inspecting token exchanges, request headers, replay protection, and calls to Okta’s APIs; React and Vue variants are also noted. It recommends IndexedDB with non-exportable WebCrypto keys, cleanup during sign-in, and browser capability checks, while noting that the preserved setup instructions no longer work exactly as written after Okta’s May 2025 account changes.


### [How to Use Okta's PowerShell Module to Manage Your Okta Org](https://yomu.fyi/post/how-to-use-okta-s-powershell-module-to-manage-your-okta-org.md)
- Company: [Okta](https://yomu.fyi/company/okta.md)
- Author: Louie Campagna
- Published: May 7, 2024
- Type: Tutorial

The tutorial shows how to use Okta’s official PowerShell module to administer an Okta org, covering authentication, user operations, group management, and broader API automation. It requires a PowerShell terminal, the module installed from the PowerShell Gallery, Chocolatey, or GitHub, plus an Okta Developer Edition account for the setup described. Authentication uses an OIDC Native application with the Device Authorization grant, a client ID, the org base URL, and the okta.users.manage and okta.groups.manage scopes; Invoke-OktaEstablishAccessToken completes authorization. Examples search and retrieve users, create and update profiles, create groups, add users, and inspect memberships with PowerShell pipelines and formatting cmdlets. The demonstrated workflow connects successfully and manages users and groups, while the same techniques are presented as applicable to other Okta API endpoints.


### [Build and Integrate Universal Logout with Okta](https://yomu.fyi/post/build-and-integrate-universal-logout-with-okta.md)
- Company: [Okta](https://yomu.fyi/company/okta.md)
- Author: Semona Igama
- Published: Apr 30, 2024
- Type: Tutorial

The tutorial builds Universal Logout for an OIDC-enabled SaaS Todo application so enterprise administrators can end suspicious user sessions after account compromise or other detected risk. It explains how to create a /global-token-revocation endpoint, connect it to the Express app, identify a user from the revocation request, and invalidate that user's application session. Initial protection uses an API key, while the updated flow upgrades authorization to OAuth 2.0 Private Key JWT with the Okta JWT Verifier library. The tutorial then exposes the endpoint publicly, configures Okta Admin Console integration, and describes optional OIN submission with Private Key JWT and an email identifier for sub\_id. In the test, an admin clears the user's sessions and tokens; the Todo app redirects the user to login when they attempt to add a task, demonstrating Universal Logout works.


### [Add Step](https://yomu.fyi/post/add-step.md)
- Company: [Okta](https://yomu.fyi/company/okta.md)
- Author: Alisa Duncan
- Published: Mar 12, 2024
- Type: Tutorial

The tutorial shows how to add OAuth 2.0 Step Up Authentication Challenge support to an Angular frontend and NestJS backend, so sensitive routes and API resources can require stronger authentication than ordinary access. It starts from a Lerna monorepo, configures an OAuth 2.0/OpenID Connect single-page application, and uses Okta libraries plus an Okta JWT Verifier to establish the basic authenticated app. The implementation checks authentication assurance through token ACR claims, returns the standard insufficient\_user\_authentication error when an API request lacks the required assurance, and uses Angular interceptor and application-code handling to redirect with acr\_values before retrying. It also describes authentication recency through max\_age and auth\_time, while noting that the original Okta CLI instructions no longer work exactly as written after the May 2025 account-plan change.


### [Flexible Authentication Configurations in Angular Applications Using Okta](https://yomu.fyi/post/flexible-authentication-configurations-in-angular-applications-using-o.md)
- Company: [Okta](https://yomu.fyi/company/okta.md)
- Author: Alisa Duncan
- Published: Feb 28, 2024
- Type: Tutorial

This tutorial shows how to configure Okta authentication in an Angular standalone application, comparing values embedded in the app, build-time environment files, and runtime-loaded configuration. It scaffolds an Angular 17 project, creates an Okta OAuth 2.0/OpenID Connect single-page client, installs @okta/okta-angular 6.3 and @okta/okta-auth-js 7.5, and wires routes, guards, claims, and an authorization-header interceptor. Runtime configuration is served from src/api/config.json and loaded during startup through APP\_INITIALIZER, using HttpBackend so the authentication interceptor does not intercept the configuration request; the resulting properties populate OktaAuthConfigService. The sample verifies sign-in, profile access, protected routes, and sign-out, while noting that the original Okta CLI instructions are deprecated and no longer work exactly as written after May 2025.


### [Winners of the AI and Identity Okta Hackathon 2023](https://yomu.fyi/post/winners-of-the-ai-and-identity-okta-hackathon-2023.md)
- Company: [Okta](https://yomu.fyi/company/okta.md)
- Author: Michael Palermo
- Published: Nov 21, 2023
- Type: Announcement

The AI and Identity - Okta Hackathon 2023 challenged developers to build applications combining identity standards with AI, drawing 576 registrants, 22 submissions, and nine eligible entries. Judges selected Facets Wellness App for first place and $10,000 plus a future Okta Dev Advocacy Podcast appearance; IHealthHist took second with $5,000, and AITrainsYou.com took third with $3,000. Facets provides snippet-based wellness modules for emotional regulation and intelligence, journaling, values, and goals, while the other winning projects address medical-history storage and AI-powered team learning. converse.ai received the $500 honorable mention for document conversations, with judging comments citing implementations of OIDC, SCIM, and AI across the winners. Separate “most supportive hacker” prizes went to Hong Tran, Monish Basaniwal, and Deependra Gaur for forum support and guidance.


### [Step](https://yomu.fyi/post/step.md)
- Company: [Okta](https://yomu.fyi/company/okta.md)
- Author: Indranil Jha
- Published: Oct 24, 2023
- Type: Explainer

Step-up authentication lets an application permit access to non-critical resources with basic authentication while requiring additional authentication for sensitive resources. The post describes how Okta Workforce Identity Cloud supports this pattern across modern OIDC applications and legacy integrations. For OIDC, applications use the /authorize endpoint’s acr\_values and max\_age parameters to request a mapped higher assurance level for a limited period, or prompt=login to force re-authentication each time. For non-OIDC applications, privileged Factor API operations can issue and verify challenges through a protected middleware layer using an Okta API token, while Okta Access Gateway can enforce step-up through advanced policies. Transactional MFA is presented as an alternative using OIDC CIBA, but the source defers its detailed treatment.


### [How to Add Authentication to .NET MAUI Apps](https://yomu.fyi/post/how-to-add-authentication-to-net-maui-apps.md)
- Company: [Okta](https://yomu.fyi/company/okta.md)
- Author: Laura Rodríguez
- Published: Jun 21, 2023
- Type: Tutorial

This tutorial shows how to add Okta-based authentication to a .NET MAUI application, covering project setup, OpenID Connect configuration, sign-in, sign-out, and platform integration. It uses IdentityModel.OidcClient, an OktaClient wrapper, an OktaClientConfiguration class, and a WebBrowserAuthenticator implementation to connect the application to Okta’s browser-based authorization flow. The walkthrough creates a native OIDC client with the Okta CLI, registers redirect and logout URIs using myapp://callback, configures dependency injection, and updates the UI to display claims after login. For Android, it adds a WebAuthenticationCallbackActivity with an intent filter for the myapp scheme and enables Custom Tabs visibility in AndroidManifest.xml. The post includes troubleshooting for NuGet configuration and runtime-pack errors, but notes that the Okta CLI was deprecated and the original instructions no longer work exactly as written after the May 2025 plan change.