Roland Guijt
Microsoft MVP and MCT, Pluralsight author
Utrecht, The Netherlands
Actions
Roland is a Microsoft MVP, MCT and Pluralsight author enjoying a constant curiosity around new techniques in software development. His focus is on all things .NET and browser technologies with a special focus on security.
As a long-time trainer and speaker, he led many courses on these topics and spoke about these topics at many international conferences. He's currently working with Duende software to help building out their products.
Links
Badges
Area of Expertise
Topics
From Human Login to Agent Identity: OAuth/OIDC Patterns for LLMs
LLMs are no longer just chat interfaces.
They’re autonomous agents that call APIs, trigger workflows, and act on behalf of users and organizations.
But OAuth and OpenID Connect were designed for secure API access and human‑centric logins, not for chains of sub‑agents, headless CLIs, and tool‑calling loops. In this session, we’ll bridge that gap.
We’ll map identity models for AI (user‑delegated, autonomous, and on‑behalf‑of) and focus on the OAuth/OIDC patterns that matter for LLMs: Authorization Code + PKCE, client credentials, and RFC 8693 token exchange for least‑privilege, task‑scoped tokens. You’ll learn how to design scopes around LLM tools, keep tokens out of prompts and agent memory, and enforce authorization in tool wrappers so policy is centralized and auditable.
We’ll also cover workload identity federation, treating AI agents as non‑human identities with dedicated credentials, tenant isolation, short lifetimes, and immediate revocation.
By the end, you’ll have a clear mental model and concrete patterns to secure LLM tool calling and agentic workflows with OAuth and OIDC—whether you’re building .NET backends, integrating with the cloud, or designing your own agent platform.
Combining OIDC, Passkeys, and Step-Up Authentication for High-Risk Actions
Modern apps increasingly need more than “logged in” versus “not logged in.”
This session explores how to combine OpenID Connect, passkeys, and step-up authentication to protect sensitive operations like payments, account recovery, email changes, and privilege escalation.
It focuses on designing flows that are both phishing-resistant and usable, while meeting stronger authentication requirements only when risk demands it.
OAuth 2.0 Step Up Authentication Challenge Protocol RFC 9470 formalizes how resource servers can request stronger or more recent authentication when the current token is not sufficient.
React Client vs Server: Showdown at Render Creek
React 19 dropped Server Components and Actions. Now it’s time to see them face off against the good old client side!
Join me for a quick‑fire showdown: we’ll pit Client vs Server, highlight where each wins, and (spoiler alert!) reveal how they actually make a killer team.
Rusty with React? No worries! I’ll throw in short refreshers so everyone’s on the same page.
OAuth: The Good Parts
OAuth has been around for more than 10 years now, and has become the standard protocol for token-based security.
Like every popular technology that has been growing with its requirements, there are some things which work really well, and some that did not quite stand the test of time.
This talk looks at the essentials you should know about, if you would enter the OAuth ecosystem today. Which protocol flows and extensions should you study, which “dialects” like OpenID Connect are important, and if you decide to dive deeper, what would that “recommended reading” list look like?
OAuth, OpenID Connect & .NET – the Good Parts
OAuth has been around for more than 10 years now, and has become the standard protocol for token-based security. Like every popular technology that has been growing with its requirements, there are some things which work really well, and some that did not quite stand the test of time.
With the upcoming OAuth 2.1 protocol revision, the protocol has been streamlined and simplified and the specification has been updated to meet modern application and security requirements.
This full day workshop teaches you all the OAuth you need utilizing the most common and practical techniques and libraries in the .NET ecosystem. Besides looking at built-in features of (ASP).NET, we will use popular frameworks like IdentityModel and IdentityServer, and we will learn how to use them to secure native/desktop and web applications as well as SPAs, Blazor WASM applications, APIs and daemons.
How Banks Protect Their Applications with FAPI
FAPI is a security profile that protects APIs in high-value scenarios where heightened security is needed.
To be considered a FAPI 2.0 compliant implementation, your implementation must use the right set of OAuth's best current practices.
Some of these practices are to use sender-constrained access tokens, to only support confidential clients, not public clients, to not use client secrets but private_key_jwt and to practice the principle of least privilege when using access tokens.
In this session you'll learn the concepts of each part and see a practical example on how it is implemented on both identity provider and client.
You might come to the conclusion that your organization need to be FAPI compliant at the end of the session but if not you'll take away at least one tip that will make a big difference in protecting your application landscape.
Blazor Authentication? Hold My Beer!
How to correctly implement authentication in Blazor depends on the mode your using it in. Blazor Server requires an approach that is totally different than when using Blazor WebAssembly. And if you use a mix of the two rendering modes things can get very complicated.
This session is here to help you out. We'll cover the right way to do cookie and OpenID Connect authentication for both modes as well as the mix mode.
At the end of the session you'll be able to confidently secure any Blazor application.
ASP.NET Core Minimal APIs and React: A Winning Team
There's a lot of smartness built into minimal APIs in ASP.NET Core which allows you to create straightforward, maintainable REST APIs while maintaining all the goodness of ASP.NET Core.
After explaining the concepts of minimal APIs, I'm showing you how such an API sticks together and I'll show you a React front-end using React Query that uses it of course.
API FOMO: REST, gRPC or GraphQL?
You want to create an API in .NET. So you use Web API right?
In fact, there are more choices which might be far more suitable for your situation.
Not only REST with Web API is possible but also gRPC and GraphQL. Come see this session to see how they work side by side. But, maybe more importantly I'll answer the question: When to use what and why?
Be Sharp with New Features in C#
New features in C# have the tendency to be somewhat theoretical in nature. It's hard to determine what's actually useful in daily life.
This session solves that problem. You'll just see demos of the latest C# features that are actually useful in practice.
Enhancements that have to do with strings, generics, lambdas, pattern matching, namespaces and immutability, just to name a few categories.
Blazor Authentication? Hold My Beer!
How to correctly implement authentication in Blazor depends on the mode your using it in. Blazor Server requires an approach that is totally different than when using Blazor WebAssembly. And if you use a mix of the two rendering modes things can get very complicated.
This session is here to help you out. We'll cover the right way to do cookie and OpenID Connect authentication for both modes as well as the mix mode.
At the end of the session you'll be able to confidently secure any Blazor application.
Blazor: Blazing into the Future of Web Development
It sounds like a dream: Using C# and .NET for both the server- and browser-part of your application. No more JavaScript. Because of the power of Web Assembly this becomes a reality.
You'll experience the advantages of this model in this session. And you will know how to create an application using it. We'll also take a look at the different hosting models of Blazor using server-side and client-side rendering. All by example.
After seeing this session you'll be ready to say goodbye to JavaScript and to write full-stack C# web applications!
Level Up Your Security: OpenID Connect/OAuth Update
So you have a well functioning Identity Provider be it in the cloud or self managed and you're like "All's well that ends well".
Don't make that mistake.
OpenID Connect and OAuth2 are living specifications. They are constantly revised because new attacks are constantly invented.
In this demo rich session we're exploring the latest developments. Did you know that implicit flow is deprecated for example? And that a request to the authorize endpoints might leak all kinds of information that can easily be prevented? And that client authentication can be way more secure than using a simple password?
Please come and join me and I'm certain you'll implement at least one of my tips as soon you're back at the office.
Workshop: Creating APIs on Steroids with gRPC
What's that in the sky? Is it a plane? Is it WCF? No it's better. It's gRPC that's now natively supported in ASP.NET Core. It's more efficient than any API technique you've ever used and it's is way, way faster. That makes it very suitable for communication between microservices.
In this workshop you'll learn what gRPC is but most importantly you'll gain hands-on experience implementing one in ASP.NET Core. Of course consumers of the API and authentication won't be forgotten.
You'll leave with the ability to create and consume APIs on steroids.
Topics:
- Theory around gRPC basics
- When to use it and when not to use it
- HTTP/2 in-depth
- Creating a gRPC service from scratch
- Creating clients
- Augmenting services
- Implementing streaming support
- Authentication and authorization
Computer setup:
You will need a laptop with Visual Studio 2022
Working with Immutability and Records in C#
Immutability is an important feature to have in a programming language.
Unfortunately C# hasn't been very good at it: UNTIL NOW! With Records and other language enhancements we can finally code using immutable types.
In this session you'll learn why that is important and of course we'll zoom into the new Record type and see what makes it tick!
OAuth2 and OpenID Connect: Easy Now
Chances are that you still have applications that do their own authentication. But do you really understand the industry standards OAuth2 and OpenIDConnect? No?
Maybe because of the fact that every tutorial on the internet seems complicated.
In this session I'll explain the duo in a very easy-to-get way. I'll also show you how to set up the most simple OAuth/OpenID Connect environment possible and to build on that going forward. You'll see an OpenIdConnect identity provider and several different types of applications as clients in action.
Don't Trust the Browser: Secure SPAs with BFF
OpenIdConnect and OAuth are the industry standards to protect both frontend and backends applications with tokens.
Sending tokens to the browser is like trusting a bunch of lions to keep a cow safe. So why do we do it in our Single Page Applications using the implicit flow for example?
Don't.
BFF or Backend For Frontend solves this problem. Come and find out how this works using ASP.NET Core on the server and React on the browser side. If you're not into ASP.NET Core: come anyways because the concepts are applicable to any technology.
Real-time Web Applications with ASP.NET Core SignalR
A real-time web application is actively sending data from server to browser or other client. You already know this principle from email browser clients that pop up new emails as they come in.
In this session you'll learn to apply this technique to your ASP.NET Core application. I'll show you how to build real-time functionality into every ASP.NET Core application by diving into the code of a demo application showing you the server- and client-side.
And when your app's ready there are a couple of things you should know when you want to scale out a SignalR app. You could do the plumbing yourself or using the new Azure SignalR service.
After this session you're ready to write and deploy your ASP.NET Core SignalR application.
Getting a gRIP on ASP.NET Core gRPC
What's that in the sky? Is it a plane? Is it WCF? No it's better. It's gRPC that's now natively supported in ASP.NET Core. It uses the same underlying RPC principle of the good ol' WCF. It's just implemented better, it's more efficient and it's is way, way faster. That make it very suitable for communication between microservices for example.
In this session I'm talking about what gRPC is but also how you can implement it right away in any ASP.NET Core application. I'll not only do that by building a gRPC endpoint into an existing ASP.NET Core application, but you'll also learn that on the consuming side there are also a lot to like.
You'll leave with the ability to create and consume APIs on steroids.
Blazor: Blazing into the Future of Web Development
You're starting a long-term relationship with Blazor in this full-day workshop. Throughout it you'll build components for existing applications but not before you get a clear explanation of each step we take.
Here's what you'll learn:
- What is Blazor?
- The different hosting models.
- Writing a basic component
- Understanding how a component is processed
- Databinding
- Handling and creating events
- Advanced component capabilities such as cascading values, attribute splatting and component references
- Creating highly reusable component templates
Blazor Components Deep Dive
Met Blazor components kun je veel meer dan wat je in "Getting started" sessies en blog posts ziet.
In deze sessie zoomen we specifiek in op het Blazor component zelf. Ik ga er vanuit dat je weet wat Blazor is. We kijken onder meer naar hoe event propagation, child content, attribute splatting en een chained bind werkt en je zult leren hoe templated components werken.
Na deze sessie kun je veel meer dan alleen een "Hello world" applicatie maken in Blazor.
Authentication Your Own Way
An identity provider enables you to do centralized authentication with single sign-on using industry standards. Cloud services are great as long as you don't need customization beyond of what it offers. This is where creating your own with IdentityServer comes in.
I'll show you the ins and outs of creating the service and how to deploy it to Azure.
But not before I make sure you understand the terminology around it. Once you get the basics we'll get into beyond the basics mode and I'll show you some of the other marvelous things that a custom identity provider brings.
After this session you're ready to implement a identity provider in ASP.NET Core that supports authentication across your organization.
ASP.NET Core Minimal APIs and React: A Winning Team
There's a lot of smartness built into minimal APIs in ASP.NET Core which allows you to create straightforward, maintainable REST APIs while maintaining all the goodness of ASP.NET Core.
After explaining the concepts of minimal APIs, I'm showing you how such an API sticks together and I'll show you a frontend that makes the most out of it using the immensely popular React, that can use React-Query to talk to our minimal API in a very smart way. without having to worry about things like caching and refreshing data anymore!
DevSum 2023 Sessionize Event
Techorama 2023 Belgium Sessionize Event
DevSum 2022 Sessionize Event
NDC Porto 2022 Sessionize Event
Roland Guijt
Microsoft MVP and MCT, Pluralsight author
Utrecht, The Netherlands
Links
Actions
Please note that Sessionize is not responsible for the accuracy or validity of the data provided by speakers. If you suspect this profile to be fake or spam, please let us know.
Jump to top