Vittorio Bertocci
- Long-running 'Identity, Unlocked' podcast
- Books on Windows Identity Foundation and modern authentication
- Foundational identity advocacy at Microsoft and Auth0
Bio
Vittorio Bertocci spent two decades teaching developers how identity protocols actually work. His books, talks, and the long-running "Identity, Unlocked" podcast made OAuth and OpenID Connect comprehensible to a generation of engineers. He worked at Microsoft for many years before joining Auth0, then Okta after the acquisition.
Vittorio passed away in 2023. The community continues his podcast and educational legacy.
Profile built from public press and the Identity, Unlocked podcast archive.
Where their work shows up
Bertocci's teaching is why a generation of developers understand the difference between an ID token and an access token, which remains the single most common source of authentication bugs. His explanations of OpenID Connect and claims validation are still the clearest starting point.
Related on Start with Identity
- GlossaryAgentic Identity
Identity for autonomous AI agents that act on a user's behalf, call APIs, and chain tools. Requires scoped, delegated, auditable, and revocable credentials rath
- GlossaryAuthorization Code Flow
The recommended OAuth 2.0 flow for apps with a user: the app receives a short-lived code, then exchanges it for tokens from a back channel. Combined with PKCE f
- GlossaryClient Credentials Grant
An OAuth 2.0 flow where an application authenticates as itself, with no user present, to obtain an access token. The standard pattern for machine-to-machine acc
- CVEDrupal Simple OAuth/OIDC auth bypass via an alternate path
Drupal Simple OAuth / OIDC 6.0.0 through 6.0.6 allowed authentication to be skipped on an alternate path. Patched in 6.0.7.
- CVEDuende OAuth token management mixes tokens across requests
A race in Duende's .NET OAuth token-management package could attach client A's token to client B's request. Session mix-up, not a crypto break, but it is still
- CVEOAuth 2.0 private_key_jwt audience ambiguity
A specification-level flaw in the OAuth 2.0 JWT profile: private_key_jwt audience is ambiguous, so a token minted for one authorization server can be accepted b