CTO Craft Con London 2026
A review of the changes in 2025 and my plans for 2026.
Scott Brady - scottbrady.io
Articles on Identity, Authentication, OAuth, and ASP.NET Core.
Latest posts
Year in review: 2024
A review of the changes in 2024 and my plans for 2025.
Understanding WS-Federation: A modern primer for an obsolete protocol
A modern overview of the WS-Federation protocol, focussing on the parts of the protocol that are still in use and somewhat useful to know.
Year in review: 2023
A review of the changes in 2023 and my plans for 2024.
Book notes & reflections: An Elegant Puzzle
An overview of the book “An Elegant Puzzle: Systems of Engineering Management” by Will Larson, including some of my key takeaways, how they relate to my own experience, and what I am trying to implement as a result.
Loading RSA Keys in .NET
How to create your own RSA key in .NET or load one from a JSON Web Key, a PEM file, or an X.509 certificate.
Challenges 7-12: Implementing and breaking AES ECB
Implementing AES with ECB and CBC block cipher modes and brute-force decrypting your first encryption oracle.
Year in review: 2022
A review of the changes in 2022 and my plans for 2023.
Book notes & reflections: The Making of a Manager
An overview of the book “The Making of a Manager: What to Do When Everyone Looks to You” by Julie Zhou, including some of my key takeaways, how they relate to my own experience, and what I am trying to implement as a result.
OAuth client authentication - more than just client secrets
Learn the pros and cons of each OAuth client authentication mechanism and take your OAuth security beyond client secrets.
Book notes & reflections: The Art of Leadership
An overview of the book 'The Art of Leadership' by Michael Lopp, including some of my key takeaways, how they relate to my own experience, and what I am trying to implement as a result.
JWT creation and validation in Python using Authlib
Learn how to create and validate JSON Web Tokens (JWTs) in Python using the Authlib library, JWT security best practices, and claims validation.
Understanding JSON Web Encryption (JWE)
Learn how JSON Web Encryption (JWE) works with a walkthrough of the token format, best practices, and the encryption algorithms available to you.
New Pluralsight Course: JSON Web Token (JWT) Fundamentals
Learn how to use JWTs securely with my latest course on Pluralsight: JWT Fundamentals.
Open Banking for OAuth Developers
Learn how the UK's Open Banking makes use of OAuth and OpenID Connect.
Step-up authentication with OAuth and OpenID Connect
Learn how to implement and trigger standards-based step-up authentication using OAuth, OpenID Connect, and SAML.
Year in Review: 2021
A review of the changes in 2021 and my plans for 2022.
Umbraco frontend membership SSO using OpenID Connect
How to log into an Umbraco website as an end-user via an external SSO solution such as IdentityServer, Google, or Auth0.
Goodbye, Rock Solid Knowledge; Hello, 10x Banking
Why I have left Rock Solid Knowledge, what I’m doing in my new job at 10x Banking, and what, if anything, will change on this website.
Understanding identity tokens
A deep dive into OpenID Connect’s ID token, looking at what identity tokens are, what they are not, where to use them, and how to validate them.
Umbraco backoffice SSO with OpenID Connect
How to log into the Umbraco backoffice using an external identity provider such as IdentityServer, Azure AD, or Auth0.
How I use Polywork to overcome impostor syndrome
Polywork is a new social media platform that I’ve been using to track my recent achievements, both big and small, and to tackle my ongoing impostor syndrome.
How to sign XML using RSA in .NET
How to sign XML in .NET and .NET Core using an RSA key while avoiding common XML security pitfalls.
ECDSA and Custom XML Signatures in .NET
Drag your XML signing into the 2020's with modern cryptography by signing XML with ECDSA.
Loading Elliptic Curve (EC) Keys in .NET
Four different ways of loading Elliptic Curve (EC) keys in .NET for use with Elliptic Curve Digital Signature Algorithms (ECDSA).
Umbraco MVP 2021
I’m an Umbraco MVP for 2021! This was awarded in recognition of my contributions to the Unicore project, where Rock Solid Knowledge helped Umbraco migrate their user store to ASP.NET Core Identity.
Client Authentication vs. PKCE: Do you need both?
Learn how OAuth Proof-Key for Code Exchange (PKCE) does not replace client authentication (e.g. secrets) and why you should use both where possible.
Authenticated Encryption in .NET with AES-GCM
Learn how to use AES-GCM encryption in .NET for authenticated encryption, giving you the usual confidentiality and an additional integrity check.
Beware of Password Shucking
Learn how password shucking attacks rehashed or pre-hashed passwords by stripping your password hashes of their strong outer password hashing algorithm.
Integrating ASP.NET Identity Password Policies with Password Managers
Learn how to automatically set HTML passwordrules based on your ASP.NET Identity password options, using the newpassword tag helper from ScottBrady.IdentityModel.
Perfecting the password field with the HTML passwordrules attribute
Learn how to integrate sign up forms with password generators by using the autocomplete and passwordrules HTML attributes.
New Pluralsight Course: Getting Started with SAML 2.0
SAML is the protocol that no one wants to use. But if you must use it, at least you now have a modern, detailed introduction to SAML thanks to my new Pluralsight course.
Year in Review: 2020
A review of what little I got up to in 2020 and my plans for 2021.
OAuth is Not User Authorization
Avoid a common OAuth pitfall by learning how OAuth consent and access tokens differ from user-level authorization policies.
XChaCha20-Poly1305: A Primer with Examples in .NET
Learn the introductory theory behind XChaCha20-Poly1305, a standby cipher for symmetric encryption, and how to use it in .NET with libsodium or implement it yourself by 'rolling your own crypto' on top of Bouncy Castle.
PEM Loading in .NET Core and .NET 5
Learn how to load keys and certificates from PEM files in .NET. With code samples showing the new APIs added in .NET 5 and how to use PEM certificates with Kestrel.
Recording: Let's stop blaming our users for getting hacked when it is our problem to solve
My talk from NDC Oslo 2020. Learn how current user authentication isn't good enough and how you can solve the password problem with FIDO2 and WebAuthn.
JWTs: Which Signing Algorithm Should I Use?
Learn the difference between each JOSE algorithm (e.g. RS256, ES256, EdDSA) and how to choose the best one available to you.
Creating RSA Keys using OpenSSL
An OpenSSL cheat sheet for creating RSA private keys, public keys, and certificates for use with RSASSA-PKCS1-v1_5 and RSASSA-PSS.
OAuth Security Workshop 2020
My experience and highlights from the OAuth Security Workshop 2020. Including new OAuth topics such as online_access, app2app, FAPI, OAuch, and Web ID.
Using ECDSA in IdentityServer4
How to use ES256 to sign JWTs in IdentityServer4 while still supporting RS256 for backward compatibility.
Creating Elliptic Curve Keys using OpenSSL
An OpenSSL cheat sheet for creating EC private keys, public keys, and certificates for use with ECDSA.
Adding Tailwind Utility Classes to your Bootstrap Website
How to use Tailwind CSS and Bootstrap 4 side-by-side.
Using Biometrics in ASP.NET Core
Physical biometrics, such as fingerprint or facial recognition, are super useful when logging into mobile apps. So why can't you use biometrics in the browser?
EdDSA for JWT Signing in .NET Core
A primer on EdDSA and how to use it for JWT signing in .NET Core using Bouncy Castle and ScottBrady.IdentityModel.
Replacing JWTs with Branca and PASETO in .NET Core
Branca, PASETO, XChaCha20-Poly1305, and Base62 support in .NET Core using ScottBrady.IdentityModel.
Alternatives to JSON Web Tokens (JWTs)
JWTs get a lot of hate from the crypto community, but what are the alternatives? In this article, I look at implementations such as Branca and PASETO to see how they compare to JWTs.
Outsourcing IdentityServer4 Token Signing to Azure Key Vault
How to outsource IdentityServer4 JWT signing to Azure Key Vault. No private keys were downloaded in the making of this article.
Building a FIDO Authenticator with OpenSK
My experience with OpenSK, an open-source FIDO2 authenticator implementation, using a VirtualBox VM and FIDO2 for ASP.NET.
IdentityManager2 2020 Update
New features in IdentityManager2 with ASP.NET Core 3.1 and SameSite cookie support.