Brian Campbell
- Co-author of multiple OAuth working group RFCs
- Long-time IETF identity working group contributor
Bio
Brian Campbell is one of the most consistent IETF identity contributors of the modern era. His name appears across OAuth 2.0 token binding, DPoP, and many JWT-adjacent specifications. Distinguished Engineer at Ping Identity.
Profile built from public IETF records. Vendor affiliation disclosed.
Where their work shows up
Campbell's contributions cluster around the hardest remaining problem in OAuth: bearer tokens are replayable by whoever holds them. DPoP binds a token to a key the client proves possession of, which is the direct answer to token theft from browsers and infostealer logs. See also mTLS for the sender-constraining approach where you control the transport.
Related on Start with Identity
- GlossaryAccess Token
A short-lived credential a client presents to a resource server to access protected data. Access tokens are typically opaque or JWT-formatted, with lifetimes me
- GlossaryOpenID Connect (OIDC)
OpenID Connect is an authentication layer built on top of OAuth 2.0. Where OAuth tells you what a token is authorized for, OIDC tells you who the user is via a
- CVEWordPress OAuth SSO plugin JWT bypass, admin takeover
The OAuth SSO WordPress plugin through 6.26.12 failed JWT signature verification. A forged token becomes an administrator. Patched in 6.26.13.
- GlossaryAgentic Identity
Identity for autonomous AI agents that act on a user's behalf, call APIs, and chain tools. Requires scoped, delegated, auditable, and revocable credentials rath
- CVEAuth0 node-jws HS256 verification bypass via secret lookup
node-jws before 3.2.3 / 4.0.1 can accept an HS256 JWT when the caller looks up the secret from attacker-controlled input. Medium on paper, but it is a signature
- CVEDrupal Simple OAuth/OIDC auth bypass via an alternate path
Drupal Simple OAuth / OIDC 6.0.0 through 6.0.6 allowed authentication to be skipped on an alternate path. Patched in 6.0.7.