RTS Questionnaire · Question 08 of 52 · file: answers/q08.html
Have you worked with OAuth 2.0, OpenID Connect, or other authentication and authorization frameworks?
SecurityOAuth2Identity
✅ Yes — identity and access management is a recurring responsibility in my API and front-end deliveries.
🧪 Interactive proof: this answer has its own page with a live OAuth 2.0 / OIDC workflow, the code behind it and the acceptance criteria — open the Q08 identity proof →
Technical detail
- 🔐 OAuth 2.0 flows — Authorization Code with PKCE for SPAs and mobile clients, Client Credentials for service-to-service calls, refresh-token rotation, scopes and audience validation; legacy flows understood well enough to migrate away from them.
- 🪪 OpenID Connect — ID tokens, UserInfo, discovery/JWKS endpoints, signature and issuer validation, and integration with providers such as Microsoft Entra ID (Azure AD), IdentityServer/OpenIddict-style servers, Auth0/Keycloak-style deployments and social logins.
- 🧱 Application security layers — JWT/OAuth2 plus role- and claim-based authorization (policy handlers, resource-based checks), ASP.NET Core Identity and Spring Security equivalents, API keys for partner integrations and mTLS for internal service boundaries.
- 🛡️ Hardening — short token lifetimes, secure cookie/CSRF strategy, CORS allow-lists, secret management in Key Vault/Secrets Manager, least-privilege scopes, audit logging and brute-force/rate-limit protection.
🧪 I validate the whole path with integration tests (token issuance, expired/invalid signature, insufficient scope → 401/403) so security regressions are caught in CI rather than in production. 🔎 Recent delivery example: an Angular SPA + .NET API protected with JWT bearer authentication, plus Azure-side identity configuration in cloud integration scenarios.
🧾 CV evidence: 2025 CV technology taxonomy lists 'REST / OpenAPI, OAuth2 / JWT'; DMS Angular + .NET assessment documents Swagger + JWT authentication; Azure security coursework (AZ-500 Microsoft Azure Security Technologies) and AWS Security Specialty certification.