The OIDC specification describes it as "a simple identity layer" on top of OAuth2 . As I've beendiscovering , thisis sort of technically true but also misleading. Since I think I'vefinally sorted this out, here's what I've come to understand aboutthe relationship.

OAuth2 describes a HTTP-based protocol where a client (typicallyusing a web browser) can obtain an access token from an authorizationserver and then present this token to a resource server to gainaccess to

In OIDC ,roughly speaking and as I understand it, there are three possibleroles: the identity provider ('OP'), a Client or 'Relying Party'(the program, website, or whatever that has you authenticate withthe IdP and that may then use the resulting authentication information),and what is sometimes called a 'resource server', which uses theIdP's authentication information that it gets from you (your client,acting as a RP). 'Resource Server' is actually an

One part of the news of the time interval is that the US courts mayrequire Google to spin off Chrome ( cf ).Over on the Fediverse, I felt this wasn't a good thing :

I have to reluctantly agree that separating Chrome from Google wouldprobably go very badly¹. Browsers are very valuable but also veryexpensive public goods, and our track record of funding and organizingthem as such in a way to not wind up captive to something is prettybad (see: Mozilla, which is at

Any authentication and authorization framework, such as OIDC , needsa way for the identity provider (an 'OIDC OP') to provide informationabout the person or thing that was just authenticated. In OIDCspecifically, what you get are claims that are grouped into scopes . You have to ask forspecific scopes, and the IdP may restrict what scopes a particularclient has access to . Well, that is notquite the full story, and the full story is complicated (more sothan I expected when I started writing

We are almost all of the wayto the end of a multi-month process of upgrading our ZFS fileservers from Ubuntu 22.04 to 24.04 by alsomoving to more recent hardware. This involved migrating all of ourpools and filesystems, involving terabytes of data. Our traditionalway of doing this sort of migration (which we used, for example,when going from our OmniOS fileservers to our Linux fileservers was thegood old reliable 'zfs send | zfs receive' approach of sendingsnapshots

A long time ago I wrote up some basic customizations of Cinnamon , shortly after I started using Cinnamon ( also ) on my laptopof the time. Since then, the laptop got replaced with another one and various things changed in both the landof Cinnamon and my customizations ( eg , also ). Today I feel like writingdown a general outline of my current customizations, which fallinto a number of areas from the modest but visible to the large butinvisible.

The large but invisible category is that just like on

DANE is commonly cited as as "wouldn't it be nice" alternative to thecurrent web TLS ('PKI') system . It's my viewthat DANE is an example of why global DNS isn't a database andshouldn't be used as one . The usual way to describeDANE is that 'it lets you publish your TLS certificates in DNS'.This is not actually what it does, because DNS does not 'publish'anything in the sense of a database or a global

Tailscale is a well regarded commercial mesh networking system,based on WireGuard, that can be pressed into service as a VPN aswell. As part of its general features, it allows you to set upvarious sorts of DNS settings for your tailnet (your own particular Tailscale mesh network),including both DNS servers for specific (sub)domains (eg an'internal.example.org') and all DNS as a whole. As part of optionallybeing VPN-like, Tailscale also lets you set up exit

OPKSSH ( also ) is a clever wayof using OpenID Connect (OIDC) toauthenticate your OpenSSH sessions ( it's not the only way to dothis ). How it worksis sufficiently ingenious and clever that I want to write it up,especially as one underlying part uses a general trick.

OPKSSH itself is built on top of OpenPubkey , which is a trick toassociated your keypair with an OIDC token. When you perform OIDCauthentication, what you get back (at an abstract level) is a signed