to get to the second clip here where he goes on and then on top of it you're caught up in a system in which the employer has every incentive and every interest to squeeze the part that's paid to you thereby increasing what's left over for him in what you produce get more out of you give less to you it's endless isn't it get you to do a little task extra get you to go quicker to the bathroom yeah so god forbid we increase we increase productivity god forbid we increase productivity god forbid we do things faster god forbid we yeah that's how you get paid more because the fact is that as you become more productive you get paid a higher wage because that do it faster makes you more productive and if you learn how to do it faster there's more competition there's more there's more people who are higher right so he resents the fact and imagine now if the workers this were democratized you got to choose all these things then what is the incentive to make it faster what is the incentive to make it better what is the incentive to work a little harder are we going to vote on that who's going to vote on that really is it going to be voted on no it's not going to be voted on nobody's going to vote majority wise to work harder to work faster or as he says in a minute let's see oops make sure you come on time and come on time don't leave the picture always always and if there's a machine that can make you more productive or make you unnecessary oh boy well then let's not have machines let's not have machines now imagine if that were the attitude at the beginning of the industrial revolution then there is no industrial revolution let's not have machines that make us more productive because then some of us might lose jobs and you know we'll have to work with a machine i don't like machines i don't want to work with a machine no innovation no forward progress we're all back to be subsistence farming marxism is the economic ideology that drives us to all be subsistence farmers it goes backwards it undoes capitalism and works us backwards towards a world in which we have nothing nothing that's the goal that's you know that's their purpose their purpose is destruction all right um let's see keep going age quickly impact on you who cares use what's the impact on you if you don't use them machine and your productivity goes down the only reason wages have gone up over the last 200 years is because productivity has gone up the only reason we have a middle class we have all these people who are so wealthy that we have such a high standard of living is because of increases in productivity and then he is laughing at it mocking it i mean the hatred spewing from this guy is truly that the best days and the best hours of your adult life in an institution that tells you in a thousand ways don't give a shit about you in capitalism of course you are as marx love to say free and here's what the freedom means you can leave the employer and go find another one or you can go start your own business or you can go back to the farm and grow your own food you can do a lot of different things what freedom actually means is the lack of coercion nobody's cursing you you can go back to your ancestral farm you can go and start a business you can starve or you can choose your job but they again assume stuff is just there resources is just there and we all have equal rights to them because they're not created by anybody and then we should just get our fair share and we should just be allowed to all be roaming around the world naked you know and just access resources wherever we need them i mean it's just such garbage such nonsense freedom from want freedom from everything but of course but of course the majority the one freedom but you don't have is freedom from coercion because freedom from coercion what if the majority decides to curse you to tax you to lower your wages to fire you what if the majority decides to take your stuff to steal your innovation then it's fine then it's okay then there's no problem hoping against hope that the other one won't treat you as nastily as the one now no left did employers along are all nasty they treat you with nastiness is that your experience is the mic level off the charts for real am i really really loud all right we can adjust that is that hopefully that's better all right tell let me know if that's better really is that your experience with work i mean if it is your experience with work then you should you should you don't find a different job i mean this is why i always recommend people go listen to steve jobs's commencement address to students at stanford because you know he says they follow your passion love what you do go do something you really really really love if you hate your job find another job if you really treated like garbage by your employer you shouldn't be working there and i know it's hard to leave a job i know it's risky but really so he's louder than i am let me let me just uh let me let me get the volume right here this doesn't work that well all right i mean remember at the end of the day mox's utopia is is truly of that naked savage mox's utopia is everything is just available it we can all do whatever we want to do whatever we feel like do whatever we have a passion to do and everything that we need is just there it's just available and we we don't need to be we don't need money because the stuff is just there you don't need to buy it it's just available and we all produce because we love producing and we don't work for one another because we can all produce the stuff ourselves we've reached such a level of ability it's such a science fiction detached from reality unhuman system that he project and he never explains never explains it is books how we get there how do you go from where we are today to there there's a workers revolution there's by the way a workers dictatorship there's the dictatorship of the parliamentarian and then somehow through this dictatorship of the parliamentarian we evolve into this utopia but the fact is that the dictatorships of the parliamentarian so far experienced in the history of the world have resulted in over 100 million people dead that's what it's resulted in so don't give me this nonsense this pretense that there is some utopian system capitalism is an amazing system and if you're not happy with your job if you're not happy with the work that you do if you're not happy doing what you're doing do something else take more responsibility over your life be brave have courage have a backbone take some risk god and a very constricted notion of what freedom means yeah watch this wolf lays it out now i want to go a little bit into the the profit motive aspect of all this because profits that these companies make these these massive companies they don't benefit the employees of these companies i mean you think if your labor is producing the company they don't benefit the employees they make the jobs of the employees possible there are no jobs without profit profit makes the jobs possible there are no jobs without an entrepreneur without capitalists without profit right somebody says i'm telling you to learn to code no i'm telling you to go and enjoy the work that you do lots and lots of money lots and lots of profit shouldn't that benefit you doesn't that mean that your labor helps you you spend the best days and the best hours of your adult life in an institution going well today i don't know why it's so um the employees of these companies i mean you think if your labor is producing the company lots and lots of money lots and lots of profit shouldn't that benefit you doesn't that mean that your labor helped to create that it helps to create it and it does benefit you you get a job you get a salary maybe you have a profit sharing plan maybe you own some stock maybe you have a pension that opens the stock but yeah it benefits you directly but that's not what happens all you have to do is read the headlines every week i mean you had gm close five plants laid off 14 000 people so oh i guess that means gm was doing terrible right no gm made 2.5 billion dollars in profit the previous quarter 2.5 billion dollars in profit in the previous quarter the next quarter they close five plants lay off 14 000 people where the benefit's going to the top obviously they spent 295 times more than the average gm worker makes on ceo pay alone 22 million dollars the ceo makes 22 million dollars 295 times more than the average gm but the reason is that the ceo produces 295 times more it's almost impossible to find a ceo who can manage a business like that and if he manages it badly if he's not a good if he's not a good ceo what happens to all those workers they all lose their jobs they all lose their jobs so you better get a good ceo because without a good ceo you guys don't have jobs you really don't ceos i mean there's no appreciation for the ceo does the extent of the skill needed the extent of the responsibility i mean all those jobs are up to him doing a good job when the ceo of gm doesn't do a good job which he often doesn't people lose their jobs people are fired and that's not good for anybody all right let's see what else he has to say that's where the money goes they spent 14 billion dollars on stock buybacks to artificially inflate their own stock no received 3.29 billion dollars in taxpayer funded bailout money in 2008 this is a company living off of taxpayers all right this thing won't mute and where does all their money all right so bailouts you know i'm against bailiffs of course they shouldn't have gotten bailout but but stock buybacks stock buybacks don't artificially inflate stock prices they do not artificially inflate stock prices when you buy back a stock in a sense you're returning capital to your stockholders for them to invest somewhere else which creates more jobs elsewhere it's a net benefit to the economy and basically what you're saying when you do a stock buyback as a company is just saying this money is better in your hands you have better investment opportunities than i do because if i invest it i'm not going to get a good rate of return they're just no opportunities for me and my business to invest this money so i'm giving to you my investors to go and invest it is something that can return a higher rate of return and by doing so they will be allocating money to businesses that have the potential to hire more people to grow to innovate and to produce a higher standard of living all right i'm gonna i mean the whole these people really i mean and i'm not saying this they just have no no understanding of economics of finance of business of how a company runs of how a company is managed of what a stock market is and what a stock is and how a stock is priced and what happens when you buy back your stock they have no idea of finance theory economic theory any of it basic stuff basic finance basic economics they are completely and utterly ignorant of all of it so david says but wait a minute you're on there must push stock prices up when you buy back the stock well let's think this through so i have a billion dollars of cash right and they use that billion to buy the stock now you would say the stock goes up because there's increased demand for the stock but how long does it stay up because when i owned the stock before the buyback i had i owned in a sense let's say i own 10 percent of the stock of a company to make it simple i own 10 percent of the stock of a company i own all its assets all its future cash flows and a billion dollars now they take the billion dollars and they buy back the stock and maybe it causes the stock to go up a little bit but then when i'm sitting there as a stock holder i still own 10 percent afterwards right maybe i own only because they bought back some of the stock maybe i own they bought 10 that's a bought 10 percent of the stocks i own only 9.9 percent of the stock now but i also have a billion dollars less so my stock represents the company smaller so why would the stock price go up and it doesn't stock buybacks by themselves do not raise the price of stocks and i'll do a show and stock buybacks i'll try to i'll try to illustrate with some numbers and try to illustrate with more details all right i'm gonna call it a night i hope you enjoyed this it seems like i take these short little clips and i talk for an hour about them i did take a break there but i talked for an hour about them which is which is longer than i expect i'm not going to talk about jordan peterson tonight i'll do it on wednesday um i'll talk about it then so uh again i what i'm trying to illustrate illustrate is the sheer ignorance of people on the left of economics and i could do unfortunately i could do the same thing less so the people on the right tend to have a better understanding of economics still ignorant but better what we need today what i called the new intellectual would be any man or woman who is willing to think meaning any man or woman who knows that man's life must be guided by reason by the intellect not by feelings wishes women's or mystic revelations any man or woman who values his life and who does not want to give in to today's cult of despair cynicism and impotence and does not intend to give up the world to the dark ages and to the role of the collectivist broads


Good evening, everyone. Today I am going to talk about Hepatocellular Casinoma in disguise of giant hepatic hemangioma. Radiological imaging plays a crucial role in diagnosis of Hepatocellular Casinoma. Hepatocellular Casinoma is usually diagnosed by dynamic contrast CT or MIR imaging, showing typical contrast enhancement pattern in arterial phase and rapid washout in portovenous phase. However, there are a number of focal benign level lesions that often mimic the appearance of HCC.  Hepatic hemangioma is a common benign lesion of the liver and commonly found in females. The radiological features of both hemangioma and HCC can resemble similar often resulting in difficulty of differential diagnosis between the two and can cause preoperative definitive diagnosis or challenge. Herein we report a case of Hepatocellular Casinoma mimicking as giant hepatic hemangioma on ultrasound of abdomen and CT scan. Case report, a 70-year-old female presented to hospital with complaints of abdominal pain in the right upper quadrant since five to six months. The pain was intermittent and radiating in nature. She gave positive history of nausea, vomiting, with hardening and darts change tools. Prior to referred to her hospital, her ultrasound report suggested benign lesion possible of giant hepatic hemangioma. She was referred to her hospital and underwent clinical examination, lab investigations, and CT of the abdomen. Her LFT showed serum bilirubin was slightly raised. Serum albumin and total protein were little lower than normal. Serum HGPT was raised. Serum alkaline phosphatase was raised. CT of abdomen showed a large 16.1 into 12.5 into 20.2 centimeter size. It defined multilobylated, smooth-marginated, heterogeneously attenuating lesion with few hypodense areas within, in the right lobe of liver. The lesion showed heterogeneous enhancement of post-contrast study with enhancement of the lesion, matching the blood pool and all the phases of contrast study. Immediately the lesion was seen compressing the intra-epatic IVC. Antiretally, the lesion was seen aborting the anti-abdominal wall. Infirmedly, the lesion was seen aborting the gallbladder with near-maintained fattening between. The lesion was also seen displacing the bowel loops inferiorly. There was no evidence of calcification associated cirrhosis or infiltration into the surrounding structures. So, possibility of giant hepatic hemangioma was considered. A 5.7 mm size defect was also seen in the umbilical region through which momentum was seen protruding out. It was suggested by umbilical honey and a cyst was also seen in the upper pool of the left kidney. Infused and sub-centimeter size cysts were also noted involving the right kidney. This is the picture depicting hepatic lesion in the thin-plane study. This is in the arterial phase. It shows a well-defined lesion with no early wash-in or early wash-out. As seen in the venous phase, there is no wash-out early. This is the thin-delayed phase. So, impression was given as possibility of giant hepatic hemangioma needs to be considered. And umbilical hernia with bilateral venous cysts. So, surgical intervention of right hepatic tummy was performed. Histopath, it was given for histopathological correlation. Specimen receipt was right to protect tummy with gallbladder. Specimen showed, cut surface of the liver showed multiple nodules of varying size, almost entirely replacing the liver pancrema. The masses were solid for yellow, light tan to pale green colour. Histologically malignant cells were arranged in solid pseudo-glandular, macro-travicular and trabicular pattern. Three multi-nuclear tumour cells were also noted, but it was confined to the liver. So, our diagnosis of moderately differentiated grade-2 hepatocellular carcinoma was given. Pathology stage P2N, Pt2N. The tumour cells were also seen infiltrating into the seros of gallbladder. The diagnosis of HCC is generally made by radiological harm acts of dynamic contrast images. A large number of HCCs may have a typical radiological contrast enhancement pattern due to tumour necrosis, fibrosis, fatty change, calcification, pelletoid change, pelliotic change or portal vein thrombosis. HCCs with typical or typical radiological characteristics would mimic other benign hepatic masses, especially giant hepatic hemangioma. Several cases and research study have provided evidence of hepatocellular carcinoma, misdiagnosis of hepatic hemangiomas. So, what is the conclusion that it should be kept in mind that some tumours like hepatocellular carcinoma could mimic giant hepatic hemangioma in imaging scans. Therefore, needle liver biopsy may be essential for correct diagnosis in case of doubts or discrepancy in imaging scans. Thank you.


I come from the land where science meets spirituality, India. I chose TSE because of its all-inclusive core structure and an impeccable reputation. I come from New Delhi, India. I chose TSE because I'm interested in research in industrial organization and development microeconomics and TSE has one of the best departments in the world. TSE feels like home. The staff and professors are very accessible and helpful. Toulouse is as welcoming as its weather. It's one of the best student cities in France. It's easy, it's fun, it's safe. I'm more than satisfied with my studies at TSE. TSE offers excellent training in theoretical microeconomics. The faculty is top class and some of the younger researchers are doing excellent work in empirical economics. TSE is situated in the heart of the city near the Ponds-Empierre. Students can move from the academic life to the social life simply by stepping out into the streets of the old medieval town. I highly recommend a walk by the Garonne for inspiration and keeping the spirits high. As an enthusiastic learner, I aspire to utilize the skills that I've acquired at TSE for the common good. A common good for me would be better education just so that everybody has equal access to a better life.


You need a financial advisor with the freedom to focus on your specific needs. Whatever your goals, Reid Potter can create a game plan tailored to you. Call Reid at 432-0777 at Pikeville, Kentucky to learn more. The Pikeville Police and Fire Departments are collaborating for the Cuffs and Hoses Block Party taking place on August 19th. However, tickets are available now and more vendors are wanted for the event. The Block Party will also feature live music, street food and the Cuffs and Hoses 5K and 10K races. This is a big event for us.  It's going to be a great atmosphere. You're going to have all the placement, all the firemen there. You're going to have Dunkin' Boots. You're going to have the 5K, 10K race. You're going to have live music. You're going to have vendors. It's going to be a really, really cool event to be there and it's going to be fun. It's going to be a place in the fire in a different light than you see them in uniform and on duty. You're going to see them running. They're going to be in Dunkin' Boots. They're going to do things. We've got all kinds of things for the kids to do and we've got all kinds of things for the grown-ups to do. So it's going to be a mixture of whatever you need and it's going to be fun for everybody. The proceeds from the 5K and 10K races will be going towards shop with a trooper in December. Those interested in signing up can follow the links posted on the Pikeville Police Department Facebook page. This is for our community and to give back to our community and it's to raise money for the community. So we want to make sure, especially during Christmas, this Christmas with the first responder, that all these kids that normally wouldn't have a great Christmas will have a great Christmas. So that's what this is all about and we're going to have fun with each other and fun with the public and it's just going to be a great time. Show up. Come on. Reporting from Mountain Top News, I'm Nick Collum.


Are you the one who has been recently laid off? Or are you the one who fears that he might lose his job sooner or later? Now no need to wait for 8 to 10 years to become a resident of a country. To all my friends from IT industry, maybe it's the right time to pursue your Canadian dream. Move your skill, move your family, move yourself to Canada on our entrepreneurial programs. So contact us today. We, the lawyers at ACE, will certainly help you pursue your dream of moving to Canada.


So, with that, I will jump into the content here talking about integrating your app into the enterprise. I do have to give you a quick disclaimer, please note the slide on any forward-looking statements that we may be making during the sessions. And also, any names of organizations or companies are all fictitious, so are not intended to represent real companies. So, here we go. I'm Aaron Puraki, Senior Security Architect at Okta. I also work on a lot of the standards OAuth and OpenID Connect and SCIM in those standards groups working with a lot of other people from the industry, and I also do a fair amount of education and training on OAuth and OpenID Connect. For this session, what you can expect, we are going to talk about the difference between how enterprise companies expect to deal with identity problems and how that's different from how consumers expect to deal with identity. We'll talk about how single-sign on works and get into a little bit of the details on OpenID Connect. So, starting with how enterprise companies expect to deal with problems. Now, you are probably familiar with a typical login box with a username and password. This is a very typical way that people start building applications. And this can get you pretty far when you're building a SaaS app, and you may also then quickly realize that you need to support other social identity providers in order to be able to reduce the friction of onboarding or just getting users to come back into your application. So, maybe you've gone and added, you know, Google and Facebook login to your application just to make things a little bit easier for people. Maybe you are actually on the bleeding edge of things, and you've even added support for pass keys into your application to even further reduce the barrier to getting in. What's interesting, though, is that these all have something in common. In all of these cases, the user's account is their own account, and they're all like isolated bubbles from each other.  You maybe have them come in through different authentication mechanisms, but it doesn't really matter which one is used at the end of the day. After they're logged in, they're logged in. And again, this can take your SaaS app pretty far as you're growing and scaling your business. You may then realize that what people want is people to have team accounts, and you end up with this one person who wants to use your application with other members of their team, whether that's at a company or a small department within a larger company or just a group of volunteers or a group of friends. So let's say you go and add team support into your application where one user ends up being the team owner and is responsible for adding or removing users to that team. This is again a pretty normal growth story, but as we're quickly growing and adding more and more of these kinds of features, we're getting closer and closer to what it looks like to be a fully enterprise-ready application. Let's say that there's that one user of your app who now loves your app so much that they actually want to get their whole company on it. And it's a thousand person company, so it's definitely something where you're not going to be individually sending up users at that company anymore. In fact, their IT department wants to do a site license and buy the license outright for the whole company rather than maybe your one-off user account pricing that you had done previously. And their IT department says, oh, well, we are not going to let those users log in with their own password to your application. We're not even going to let them have their own Google authenticator, Google account or social login or even pass keys into your application. No, instead, all the users are going to sign in through the enterprise company's SSO provider. So there's no longer any concept of individual user authentication in your application. You need to support the enterprise single sign-on provider for that company. And this is just how they're going to think. This is how they think about things, is the enterprise company has a single sign-on provider that that enterprise users use to log into all of the applications that they use in that company. And there's a lot of benefits to this from the enterprise users, enterprise customers' perspective. There's one place to manage credentials. There's one place to manage multi-factor auth. If they want to require that all employees have multi-factor of a certain type, they can do it in their SSO portal. There's one place to manage who has access to which applications. They probably don't want the salespeople have the same kind of access as the developers. There's developers that need access to different tools. And this is a way for them to assign which users and which groups can access certain applications. And very importantly, it gives them a single place to revoke access, to delete users or revoke access or change and manage which groups of users in in order to shut down access when needed. So basically this means in order for your application that you're building to support enterprise customers like these, you need to support doing a single sign-on flow to their identity provider. So from your perspective, each enterprise customer is going to be a completely different identity provider. And it's kind of like if each enterprise customer was a different social connection like Facebook or Google, where you're going to have to actually build support to integrate to each of your customers enterprise SSO. So the good news is that it's not as complicated because there are open standards for this. There are well-established standards that these SSO providers and identity providers use to integrate with applications. So you can, for the most part, not exactly, but for the most part, write the code once to speak open ID and write the code once to speak SAML and then configure it to different identity providers. In practice, there are little differences between each provider, so you'll have to kind of smooth out those little bumps as you get going. But, broadly speaking, it's these two standards. So what your enterprise users will expect to see is instead of logging into your application with a password, they're going to enter just their email address. And when they enter their email address, your application can discover which identity provider they should be using to log in and send them on their way over there. So instead of your email and password or username and password box, it'll be email. Redirect over to the enterprise identity provider and then redirect back to your application and they're logged in. For example, this is what it looks like when I log into Slack. So I have my Octa employee account. I type in either my Octa email address or I know that Octa's Slack org is octa.slack.com. Click log in. I don't enter a password into Slack. I get redirected over to the Octa account where I use FastPass on the phone. That just gives me a little Face ID flash and then I'm sent back to Slack and I'm logged in and I see all the channels. And again, this is why the enterprise admins like doing this because it gives them these kinds of tools to manage who can access which of these applications that are integrated into the enterprise.  Some of them might be consumer identity providers like Facebook or Apple. Some might be enterprise identity providers specific to a customer of yours. From the enterprise perspective, they see their identity provider as a center of their universe. And they're going to see that as where they manage everything and how they're able to let applications connect to the enterprise. And they're going to be picking and choosing the best of the SaaS apps that they would like to use and putting them all together under the enterprise IDP. So we're going to go a little deeper now on OpenID Connect to talk about how you can actually do this in your application. For this session, I'm going to focus on the high level of how things work. And in the lab coming up after this session, which will be downstairs, we're going to actually walk you through step-by-step of how to do all of this. So OpenID Connect is actually built on top of the OAuth framework. You might be familiar with OAuth from granting third-party access to accounts like Twitter or Facebook, where they need to get data from some API. OpenID Connect is not about getting access to data, it's about signing in. And it's a slightly different problem, closely related. But the good news is that OpenID Connect is actually, because it's built on top of OAuth, most of the concepts apply to both. There's just one or two new things that OpenID Connect adds into the mix. The main thing that you're going to be dealing with in OpenID Connect is called an ID token. So the ID token is what encodes, it's how the server encodes data about who just logged in and what happened, any attributes about them. And the tricky part about this, which trips up a lot of people, is that ID tokens are defined in the spec as a JSON web token, as a JOT. That is OpenID Connect. OAuth has access tokens. It's always about getting an access token and using that access token to access an API. In OAuth, access tokens might be JSON web tokens, but they definitely don't have to be. And in many, especially many consumer APIs, the access tokens are not JSON web tokens. If you look at an access token from GitHub, it'll just be like a long, random string of characters. So in OAuth, access tokens don't have to be JOTs, but they often are. And there are good reasons to use JOTs as access tokens, especially if your OAuth server is OAuth 0, where it's own separate thing that is not part of your application. Plenty of good reasons for that. We can get into that later if you want. However, even though these two tokens might be JOTs, they are not the same thing, and you cannot mix them up. You can't use them interchangeably. They're for different purposes. I like to think of an OAuth access token as a key. When you get a key and you go open a door, you don't really care what are the little jaggy things on the key mean. You don't need to know that. You just need to know that you can put it in the door and turn the key and the door opens up. More digital version of that would be like a hotel key. You get a hotel key with a magnetic stripe on it, or NFC, and you don't care what's on that key. It doesn't even necessarily say who you are. It just gives you access to something. So again, even though access tokens in OAuth might be JSON web tokens, if you're thinking about this from the applications point of view of using the tokens, don't think about what's in that token. Now, OpenID Connect, on the other hand, this is where you're going to need to get into. That ID token is something you are expected to read when you're building an application that's going to be receiving an ID token. It's kind of like a receipt or like a signed statement where it says, the OAuth server says, this user logged into this application on this date with a password or with MFA and things like that. So these two tokens have different token audiences, which is a specific claim in the jot, but conceptually it just means who is meant to be reading this token. So the audience of the ID token will be the client that got the token. The audience of the access token is going to be the API where you're going to be getting data from. So let's walk through what it will look like to actually start building in an OpenID Connect flow into a SAS app. You're going to take out your password field. You don't need a password field anymore. You're going to put just an email address. They're going to type in an email, and if it matches email domain of a customer, you're going to look up the identity provider for that customer that you've got in your own little database of configuration and send them off to that customer's IDP to log in, which essentially means you're going to have some sort of mapping between email domains and identity providers of your customers. If the email address does not match, then you can fall back to your consumer login flows, like make the password box appear or prompt for a pass key or add the social login options. So let's say they entered a company email address. You did the SSO flow using OpenID Connect. You got back to your app, and now you know who they are because you were able to read the ID token. You're going to then need to have some concept of that user in your own app's database, because you're still going to need to associate records of that user with some record in your database. You're not going to rely on just the random strings you're going to be getting from these IDPs. So you'll put a record in your database, like user ID 1 came from tenant number 1, and their external user ID was this. And then if users from a different company log in, you might have user ID 4 came from tenant ID 2 with this user ID, all in your local database. Now, do you want to just caveat, don't actually use email addresses as a unique identifier for users in any world, whether that's enterprise users or consumer users, because email addresses are not actually a stable identifier, they are a means of communication. And email addresses can change for any number of reasons, like a user changes their name or a company gets acquired. So actually, there is a claim in the ID token called subject, which is a stable unique identifier for that user at that identity provider. And it'll usually be some obscure sequence of characters and numbers that are not significant to you. You just know that it is a stable identifier. So this is probably closer to what your database will actually look like. So the actual flow at a high level is you're building this application, this client, and this flow, it turns out, is going to be the same, whether you're building a mobile app, a single page app, a web server-based app. The sequence of how this works is all the same. You're going to start with the client and have your login button or your email address prompt, and then redirect the browser to the OAuth server, the identity provider. That will send the user's browser over to the authorization server, where they're going to log in there. So that's where the user sees their password prompt. They don't see a password prompt in your app. They see it at the authorization server. Once they log in, it's going to send this authorization code back into the browser, which brings it back to your application. You can then go make a request directly from your client application to the authorization server, exchanging that authorization code for the ID tokens. So the other way to look at this is in this kind of sequence diagram. So imagine that we have the browser on the left. We have the application in the middle, the client application, and the authorization server. So we don't need to go through the details of this. Here, the point is that this whole top chunk of blue lines notice how they always cross through the browser. And that's because these are all redirects back and forth, where it's not like a piece of software making a request. It's just redirecting the browser back and forth from the application to the identity provider and back. The lines at the bottom are the direct post request from your application back to the OAuth server to get the ID token. So when you get the ID token over that back channel, you can parse it out, look at the claims, and figure out who logged in. So what the user sees is a prompt they enter their email address. That'll post back up to your server. Your server checks, do I know this email domain? Is it already an existing user that's gone through some social login? You'll decide what to do with them, like redirect them to their Enterprise Identity Provider. You're not going to see what happens here, which is the entire point. They're going to log in with their own company password, their own multi-factor auth, and all that stuff is just not your problem, which is also really great. And eventually, they get sent back to your application where you can do that code exchange in your login. So the step-by-step of the OpenID Connect flow, if we just look at the URLs and the data moving around, the first thing that happens is your application builds a URL like this to the OAuth server. That's the authorization server's authorization endpoint, and you have all these parameters in the query string that are combination of configuration and runtime information. So client ID is a pre-registered value that you have to get from the OAuth server to start the flow. Redirect URL is where you want the OAuth server to send the user back to. Scope is what part of the user's account you're trying to access. So for OpenID, it's just going to be the OpenID scopes, which are OpenID profile and email, which give you access to the user's email address at that IDP. It gives you access to their name and maybe a username or other profile fields. The code challenge is the extension of OAuth called Pixi, which is a security mechanism to prevent a couple of fun and interesting attacks. So always a good idea. Once the user visits this, this is where they're going to see their login form at their enterprise IDP. Then they're going to do whatever sequence of events their IDP says they need to do to prove who they are. And that server will then create a redirect back to your application. And in that redirect will be this long string called the authorization code, which that's what you can use to get the ID token. So you're going to get this in a redirect, which means you're reading it out of the address bar. So if you're writing a single-page app, you can grab it from the address bar with window.location. If you're writing a server-side application, it'll be one of the query string parameters that your server-side app will receive. You take that. You make a post request back to the OAuth server, exchanging that authorization code for the tokens. And this is the same in OAuth and Obandi Connect, if you're doing the flow this way. The nice thing is that you can actually get both tokens at the same time. If you did need an access token for some reason, which is pretty rare in the enterprise IDP case, but very common in if you're using OAuth for you protecting your own APIs, you can get that access token and the ID token in the same response. And notice that they both start with the same few letters, because they're both JSON web tokens, which is, again, gets back to my earlier point of these look very similar, but don't mix them up. So you grab this ID token from this post request, post response that you just got, and now you're ready to actually figure out what does this mean. Well, a JSON web token is base64 encoder JSON. So you can just base64 decode the ID token, unwrap it, and see what's inside. There's three parts. There's the header, the payload, and the signature. And if you're getting it through the back channel, through this authorization code flow, you can just forget all of that and just grab the middle chunk and parse it out, because you've already done all the checks up until that point anyway. So just grab the middle part with the base64 decoder, run it through a JSON parser, and now you've got the user data. So a couple of interesting things here. Again, subject at the top, that is the unique identifier for that user at the identity provider. It's not a global unique identifier. That would be an impossible task. It is a unique identifier for this user at this identity provider. This identity provider is identified by the claim issuer, ISS, which is that one. And that is the identifier of the OAuth or OpenID server. So that pair is what you can use to be like, oh, is this the same user that I've seen before? So you can associate that issuer with a record in your database if you want to store it that way. And then the rest of these claims are either profile or log in information. So we've got user's name and email are in there. We've got timestamps of when the token was issued, when it expires. AMR is telling me how the user authenticated. So this is actually a really important one. If your application, if you know that your application has requirements that you need all the users to have a second factor, you can actually put that in the request to the OAuth server and they will get prompted for a second factor and then you can confirm it by looking at the AMR claims here. Off time, I think this is an auto-specific one, but that's the timestamp the user last entered a password in case that's relevant to you. And these are the kinds of differences that you might see, depending on the particular OpenID Connect server you're talking to is that sometimes these claims, they add their own custom claims in here. But that's how you can grab the user's info. So this is the high level. We have tons more content on this on YouTube. If you're curious, I've got a bunch of videos on there from myself that go through the details of the step-by-step of how this works in a lot more detail. But today, we are doing the OpenID Connect workshop shortly after this and the lab Enterprise Ready with OpenID Connect. In that lab, we're going to be doing exactly this sequence of events. However, we're not going to need to do much coding at all because it's gonna be done using the Auth0 Enterprise Connections feature. So we'll walk through actually adding an Enterprise Connection in the lab, modifying a very simple to-do list app in order to turn that to-do list app into an Enterprise Ready application that can use Enterprise SSO. So with that, thank you all very much and have a great rest of the day.