Social Login
Letting users sign in with an existing account from a provider like Google or Apple, usually over OIDC. Reduces signup friction but ties accounts to third-party providers.
Social login raises conversion measurably and creates a dependency worth understanding: account recovery, email changes, and provider policy shifts now happen outside your control, and a user who loses the upstream account may lose yours. Support at least one path that does not depend on a third party, and never key your user records solely on an email address the provider can change.
See also: OpenID Connect, what is CIAM, progressive profiling, CIAM vendors
Related on Start with Identity
- GlossaryClaims
Statements about a subject carried in a token, such as subject identifier, email, roles, or expiry. Relying parties make authorization decisions from claims, so
- GlossaryConsent Management
Consent management is the capture, storage and enforcement of a user's consent to specific data processing and communications, with a record of what they were s
- GlossaryIAM
IAM stands for identity and access management: the policies, processes and technology an organization uses to make sure the right identities (people and machine
- CVEKeycloak session hijack via prompt=login re-authentication
Starting a new authentication with prompt=login could hijack an existing Keycloak session. The re-auth step did not bind to the original user tightly enough. Pa
- CVEAD FS elevation of privilege exploited as a zero-day
A low-privileged local user on an AD FS server could become administrator on the box that holds the federation token-signing keys. Microsoft saw exploitation be
- BlogAmazon says more than 500 million customers have turned on passkeys
Amazon updated its passkey announcement on October 20 to say more than 500 million customers have enabled passkeys, which it says sign in about six times faster