oidc

This blog post argues that GitHub Actions lacks static OIDC audience constraints, unlike GitLab CI/CD, and that this design weakness poses an increasing security risk as OIDC-based federation becomes more common.

The author explains the differences between SSO, OAuth, OIDC, and SAML, clarifying that SSO is a user experience, OAuth is for authorization, OIDC provides identity on top of OAuth, and SAML is an older enterprise protocol.

The article criticizes the misinterpretation of Trusted Publishing as a human trust mechanism, clarifying that it is a machine-to-machine OIDC-based authentication scheme that improves security by eliminating long-lived credentials.

AGG Identify is a lightweight and secure OIDC and OAuth2 provider.

Logto is an open-source auth infrastructure for SaaS and AI apps, supporting OIDC, OAuth 2.1, SAML, multi-tenancy, enterprise SSO, and RBAC.