Skip to content
Start with Identity
Join free
Vendor podcast

Identity, Unlocked

The late Vittorio Bertocci's interviews with the authors of OAuth, OpenID Connect, FIDO, and SAML. Ended in 2022, and still the best audio archive on identity specs.

Host
Vittorio Bertocci
Publisher
Auth0 (now part of Okta) · Vendor
Pillar
Access, Authorization & Network, Workforce Identity
Level
Architect
Format
Interview
Cadence
Ended September 2022, 20 to 45 min
Status
Ended, last episode 2022-09-29
Since
2020
Episodes
26
Apple Podcasts ↗Spotify ↗
Disclosure. Produced by Auth0, which Okta acquired in 2021, in partnership with the OpenID Foundation and IDPro. The original website, feed, and the audio behind Apple Podcasts now redirect to unrelated sites. Spotify keeps its own copy, so episode links here go to Spotify.

What it is

Identity, Unlocked was hosted by Vittorio Bertocci, Principal Architect at Auth0, and produced in partnership with the OpenID Foundation and IDPro. Across 26 episodes in four seasons, from August 2020 to September 2022, he interviewed the people who wrote the specifications: Mike Jones on OpenID Connect, John Bradley on WebAuthn, Aaron Parecki on OAuth 2.1, Daniel Fett on the OAuth security best current practice and SD-JWT, and a SAML history episode with Joni Brennan, Paul Madsen, and Prateek Mishra.

Who it suits

Engineers and architects who want to understand why the standards are shaped the way they are, from the authors.

Editor note

Bertocci died in October 2023, and the show is complete. It remains the best audio archive on identity specifications, and its episodes anchor several of our learning paths, including OAuth and OpenID Connect and SAML. Warning: the original show website and feed now redirect to unrelated sites, and so does the audio Apple Podcasts plays, because it ran through the defunct Chartable tracking service. Spotify still serves its own copy; the episode links here go there. Some older episodes we could not locate on Spotify are left off our paths for now.

Where to start

  1. SAML with Joni Brennan, Paul Madsen and Prateek Mishra
    2022-08-31 · 42 min · Learner · SAML and enterprise federation

    How the SAML protocol works, who built it and why, and how OpenID Connect later took over as the place where federation innovation happens.

  2. OpenID Connect with Mike Jones
    2021-12-20 · 43 min · Practitioner · OAuth and OpenID Connect

    The design and history of OpenID Connect from one of its specification editors, covering protocol design, developer concerns, and legal aspects.

  3. System for Cross Domain Identity Management (SCIM) with Phil Hunt & Pamela Dingle
    2021-10-11 · 43 min · Practitioner · Identity governance (IGA)

    What SCIM is and how it standardizes user provisioning between systems, explained by the editor of the SCIM specifications.

Also in our learning paths

  1. Daniel Fett on privacy-preserving measures and SD-JWT
    2022-09-29 · 47 min · Architect · Verifiable credentials and digital wallets

    Surveys privacy-preserving techniques such as selective disclosure and zero-knowledge proofs, and explains how SD-JWT adds selective disclosure to JSON Web Tokens.

  2. FIDO Multi Device Credentials with Andrew Shikiar and Tim Cappalli
    2022-06-14 · 41 min · Practitioner · Passkeys and FIDO

    What FIDO multi-device credentials, now called passkeys, are and why they were introduced as a password alternative for consumer applications.

  3. The Mobile Driving License Spec with Andrew Hughes
    2022-01-10 · 34 min · Architect · Verifiable credentials and digital wallets

    Explains the ISO mobile driving license standard (ISO/IEC 18013-5), how mDL data and presentation work, and why it matters for daily life.

  4. Browser Changes on Identity Protocols with Sam Goto and George Fletcher
    2021-04-18 · 41 min · Architect · SAML and enterprise federation

    Explains how browser privacy changes to third-party cookies, iframes, and redirects affect federated login, and the classification problem of telling federation from tracking.

  5. FastFed with Darin McAdams
    2021-04-04 · 29 min · Practitioner · SAML and enterprise federation

    Explains why setting up enterprise SAML or OIDC federation and SCIM provisioning is slow and manual, and how OpenID FastFed aims to make it push-button.

  6. Continuous Access Evaluation Protocol (CAEP) with Tim Cappalli and Atul Tulshibagwale
    2021-02-22 · 35 min · Architect · Zero trust

    Explains why long-lived federated sessions need continuous signals, and how the OpenID Shared Signals and Events work on CAEP lets providers share session changes.

  7. PAR, RAR, and JAR with Filip Skokan
    2021-02-08 · 21 min · Architect · OAuth and OpenID Connect

    Explains three OAuth extensions, Rich Authorization Requests, Pushed Authorization Requests, and JWT-Secured Authorization Requests, and which core OAuth 2.0 shortcomings each one addresses.

  8. WebAuthn and FIDO2 with John Bradley
    2020-11-09 · 26 min · Practitioner · Passkeys and FIDO

    How WebAuthn and FIDO2 work, from one of the authors of the FIDO2 specifications.

  9. A Lap Around the OAuth2 Security BCP with Daniel Fett
    2020-10-24 · 34 min · Architect · OAuth and OpenID Connect

    Walks through the OAuth 2.0 Security BCP and its three biggest recommendations: drop the implicit grant, use PKCE with the code flow, and sender-constrain tokens.

  10. What's new with OAuth2.1 with Aaron Parecki
    2020-09-27 · 39 min · Practitioner · OAuth and OpenID Connect

    Explains how OAuth 2.1 consolidates OAuth 2.0 and its later RFCs, such as PKCE and the security BCP, into one document reflecting current best practice.

Last verified 2026-09-30 against the show's feed, recent episode notes, and the publisher's own pages. Status and last-episode date update weekly from the feed.

Last reviewed By SWI Community TeamSuggest a correctionHow we research

Identity, Unlocked is produced by Auth0 (now part of Okta). Listed on the same terms as independent shows.

Independent, community-driven analysis. No vendor sponsorship. Compiled from public research and community input and verified on a best-effort basis, so details may be incomplete or out of date. Scores are opinions, not advice. Trademarks belong to their owners; mention does not imply affiliation or endorsement. See the full disclaimer, or send corrections to community@startwithidentity.com.