Updated: OAuth 2.0 Token Exchange delegated implementation with Microsoft Entra ID and OpenIddict (RFC 8693)
github.com/damienbod/OA...
#entraid #oauth #openidconnect #iam #rfc8693 #openiddict #aspnetcore #dotnet
github.com/damienbod/OA...
#entraid #oauth #openidconnect #iam #rfc8693 #openiddict #aspnetcore #dotnet
GitHub - damienbod/OAuthGrantExchangeOidcDownstreamApi: OAuth 2.0 Token Exchange delegated implementation with Microsoft Entra ID and OpenIddict (RFC 8693)
OAuth 2.0 Token Exchange delegated implementation with Microsoft Entra ID and OpenIddict (RFC 8693) - damienbod/OAuthGrantExchangeOidcDownstreamApi
github.com
May 8, 2024 at 10:58 AM
Updated: OAuth 2.0 Token Exchange delegated implementation with Microsoft Entra ID and OpenIddict (RFC 8693)
github.com/damienbod/OA...
#entraid #oauth #openidconnect #iam #rfc8693 #openiddict #aspnetcore #dotnet
github.com/damienbod/OA...
#entraid #oauth #openidconnect #iam #rfc8693 #openiddict #aspnetcore #dotnet
n8n fixed CVE-2026-59208, where Enterprise token exchange could ignore issuer binding and log users into the wrong account when multiple external issuers were trusted. Affects versions below 2.27.4 and 2.28.0. #n8n #CVE202659208 #RFC8693
n8n Token Exchange Flaw Could Let Attackers Log In as Users From Another Issuer
n8n fixed a token-exchange identity-binding flaw, CVE-2026-59208, that could log an Enterprise user into the wrong account when multiple external issuers were trusted. The issue affected releases below 2.27.4 and 2.28.0, and n8n recommends patching or reducing the trusted issuer list if token exchange cannot be turned off. #n8n #CVE-2026-59208 #RFC8693...
www.hendryadrian.com
July 17, 2026 at 12:45 AM
n8n fixed CVE-2026-59208, where Enterprise token exchange could ignore issuer binding and log users into the wrong account when multiple external issuers were trusted. Affects versions below 2.27.4 and 2.28.0. #n8n #CVE202659208 #RFC8693
See MCP security in action. AAIF Ambassador @hrittikhere publishes a guide to token tiering for MCP servers—using Keycloak and RFC 8693 to provide distinct, short-lived credentials for read and write operations.
Read: https://hrittikhere.com/posts/build-secure-mcp-server-keycloak-rfc8693
Read: https://hrittikhere.com/posts/build-secure-mcp-server-keycloak-rfc8693
Build a Secure MCP Server with Keycloak, Go, and RFC 8693 Token Exchange (Part 1) | Hrittik Roy
Learn to implement token tiering in MCP servers using RFC 8693 token exchange with Keycloak, separating read and write permissions with audience-bound, short-lived tokens.
hrittikhere.com
July 15, 2026 at 8:34 PM
See MCP security in action. AAIF Ambassador @hrittikhere publishes a guide to token tiering for MCP servers—using Keycloak and RFC 8693 to provide distinct, short-lived credentials for read and write operations.
Read: https://hrittikhere.com/posts/build-secure-mcp-server-keycloak-rfc8693
Read: https://hrittikhere.com/posts/build-secure-mcp-server-keycloak-rfc8693
Hands-on: Master API Security w/ OAuth2, OpenID Connect & Token Exchange (RFC 8693).
Delegated access + service-to-service auth, with practical demos.
Details: https://f.mtr.cool/yyhdiqgrvc
#APISecurity #OAuth2 #OpenIDConnect #RFC8693
Delegated access + service-to-service auth, with practical demos.
Details: https://f.mtr.cool/yyhdiqgrvc
#APISecurity #OAuth2 #OpenIDConnect #RFC8693
Workshop: Master API Security with OAuth2, OpenID Connect, and Token Exchange - API Conference
f.mtr.cool
September 8, 2025 at 9:39 AM
Hands-on: Master API Security w/ OAuth2, OpenID Connect & Token Exchange (RFC 8693).
Delegated access + service-to-service auth, with practical demos.
Details: https://f.mtr.cool/yyhdiqgrvc
#APISecurity #OAuth2 #OpenIDConnect #RFC8693
Delegated access + service-to-service auth, with practical demos.
Details: https://f.mtr.cool/yyhdiqgrvc
#APISecurity #OAuth2 #OpenIDConnect #RFC8693
My today evening read was dedicated to the Impersonation RFC 8693 www.rfc-editor.org/rfc/rfc8693#... it highlights token exchange approaches and claims structure. I am still missing there delegation case when there is no subject token present, like support access.
RFC 8693: OAuth 2.0 Token Exchange
This specification defines a protocol for an HTTP- and JSON-based
Security Token Service (STS) by defining how to request and obtain
security tokens from OAuth 2.0 authorization servers,
including ...
www.rfc-editor.org
January 17, 2025 at 10:46 PM
My today evening read was dedicated to the Impersonation RFC 8693 www.rfc-editor.org/rfc/rfc8693#... it highlights token exchange approaches and claims structure. I am still missing there delegation case when there is no subject token present, like support access.