Phil Hunt
- Editor of RFC 7644, the SCIM protocol
- Contributor to OAuth, shared signals, and security event token work at the IETF
Bio
Phil Hunt is the editor of RFC 7644, the SCIM protocol, published in 2015 with co-authors from SailPoint, Cisco, Nexus, and Salesforce while he was at Oracle. He continues to work on IETF identity specifications, including SCIM profiles for security event tokens.
Profile built from public IETF records.
Where their work shows up
SCIM is the reason deprovisioning can be automatic. Without a standard provisioning protocol, every joiner-mover-leaver process is a custom integration per application, and the leaver half is the one that quietly fails, leaving accounts alive after someone walks out. See what is SCIM, the best SSO and SCIM platforms for B2B SaaS ranking, and identity governance for where provisioning meets audit.
Related on Start with Identity
- GlossaryAccess Token
A short-lived credential a client presents to a resource server to access protected data. Access tokens are typically opaque or JWT-formatted, with lifetimes me
- GlossaryAgentic Identity
Identity for autonomous AI agents that act on a user's behalf, call APIs, and chain tools. Requires scoped, delegated, auditable, and revocable credentials rath
- GlossaryAuthorization Code Flow
The recommended OAuth 2.0 flow for apps with a user: the app receives a short-lived code, then exchanges it for tokens from a back channel. Combined with PKCE f
- CVEDrupal Simple OAuth/OIDC auth bypass via an alternate path
Drupal Simple OAuth / OIDC 6.0.0 through 6.0.6 allowed authentication to be skipped on an alternate path. Patched in 6.0.7.
- CVEDuende OAuth token management mixes tokens across requests
A race in Duende's .NET OAuth token-management package could attach client A's token to client B's request. Session mix-up, not a crypto break, but it is still
- CVEOAuth 2.0 private_key_jwt audience ambiguity
A specification-level flaw in the OAuth 2.0 JWT profile: private_key_jwt audience is ambiguous, so a token minted for one authorization server can be accepted b