Vittorio Bertocci
- Long-running 'Identity, Unlocked' podcast
- Books on Windows Identity Foundation and modern authentication
- Foundational identity advocacy at Microsoft and Auth0
Bio
Vittorio Bertocci spent two decades teaching developers how identity protocols actually work. His books, talks, and the long-running "Identity, Unlocked" podcast made OAuth and OpenID Connect comprehensible to a generation of engineers. He worked at Microsoft for many years before joining Auth0, then Okta after the acquisition.
Vittorio passed away in 2023. The community continues his podcast and educational legacy.
Profile built from public press and the Identity, Unlocked podcast archive.
Where their work shows up
Bertocci's teaching is why a generation of developers understand the difference between an ID token and an access token, which remains the single most common source of authentication bugs. His explanations of OpenID Connect and claims validation are still the clearest starting point.
Podcasts
Hosts Identity, Unlocked.
Related on Start with Identity
- PodcastAuth0
The late Vittorio Bertocci's interviews with the authors of OAuth, OpenID Connect, FIDO, and SAML. Ended in 2022, and still the best audio archive on identity s
- GlossaryAgentic Identity
Identity for autonomous AI agents that act on a user's behalf, call APIs, and chain tools. Requires scoped, delegated, auditable, and revocable credentials rath
- GlossaryAuthorization (AuthZ)
Authorization (AuthZ) is the decision to permit or deny an authenticated subject access to a resource or action, and the rights that result; NIST's glossary, ci
- GlossaryAuthorization Code Flow
The recommended OAuth 2.0 flow for apps with a user: the app receives a short-lived code, then exchanges it for tokens from a back channel. Combined with PKCE f
- CVEDrupal Simple OAuth/OIDC auth bypass via an alternate path
Drupal Simple OAuth / OIDC 6.0.0 through 6.0.6 allowed authentication to be skipped on an alternate path. Patched in 6.0.7.
- CVEDuende OAuth token management mixes tokens across requests
A race in Duende's .NET OAuth token-management package could attach client A's token to client B's request. Session mix-up, not a crypto break, but it is still