Tag: #sso
Writing on GPUs, LLMs, MLOps, Kubernetes — and mindset · 30 posts
30 posts are tagged #sso; the most recent was published on 2026-07-17.
Often tagged together: #security 23 #keycloak 19 #oidc 18 #devops 16 #oauth2 12
Most read in the last 90 days:
- Auth Provider Shootout 2026 — Clerk vs WorkOS vs Auth0 vs Stytch vs Better Auth vs Kinde vs SuperTokens, plus the NextAuth and Lucia post-mortem
- Keycloak vs Authentik vs Zitadel vs Ory Hydra vs Auth0 vs WorkOS vs Okta — 2026 SSO / OIDC / SAML / OAuth 2.1 / FAPI 2.0 / FedCM Deep Dive
- Keycloak LDAP/Active Directory Integration — A Practical Guide to User Federation
Keycloak 26.7 — SCIM Promoted to Preview, Multi-Cluster v2 Without External Infinispan, and What to Watch in the Upgrade
Keycloak 26.7.0, released on July 9, 2026, promoted the SCIM API — a request that had been open for nearly four years — to preview, and shipped multi-cluster v2 in preview, which builds multi-cluster HA out of the databa
2026-07-17 · 16 min read #security#keycloak#sso#iam#scimBuilding SSO with Keycloak — From Realm, Client, and Flows to the 2026 New Features
Instead of bolting a separate login onto each of 20 internal apps, SSO lets a single identity server stand in for all of them. This post makes sense of Keycloak — the open-source standard — through four core concepts (Re
2026-07-09 · 9 min read #keycloak#sso#oidc#security#devopsIngress-level Authentication — Applying SSO with oauth2-proxy and Forward Auth
A practical guide to implementing SSO at the Ingress level using the external auth pattern. We walk through wiring oauth2-proxy as a forward auth service to layer OIDC login onto multiple apps without touching applicatio
2026-06-14 · 18 min read #ingress#oauth2-proxy#sso#authentication#kubernetesFrom SiteMinder to Keycloak — A Legacy SSO Migration Strategy and Practical Roadmap
A practical roadmap for migrating a SiteMinder estate to Keycloak: application inventory classification, an object mapping table, SAML brokering coexistence architecture, oauth2-proxy header translation, gradual password
2026-06-12 · 16 min read #keycloak#siteminder#sso#iam#migrationSCIM 2.0 Deep Dive — The Standard for Automated User Provisioning
SSO alone cannot manage the account lifecycle. This post takes a practitioner-level deep dive into SCIM 2.0: the spec structure (RFC 7642/7643/7644), User/Group schemas, REST endpoints and PATCH semantics, support in Okt
2026-06-12 · 18 min read #scim#iam#provisioning#sso#securityOpenID Connect Deep Dive — From the Authorization Code Flow to Discovery
A protocol-level dissection of how OIDC stacks an authentication layer on top of OAuth 2.0: the role differences between ID Token, Access Token, and Refresh Token, and the detailed Authorization Code + PKCE flow with rea
2026-06-12 · 14 min read #oidc#oauth2#jwt#sso#securityCustomizing Keycloak Tokens — Protocol Mappers and Claims Design in Practice
A hands-on guide to designing JWT claims with Keycloak Protocol Mappers and Client Scopes. Covers built-in mappers, a custom ProtocolMapper SPI implementation, audience validation pitfalls, token bloat diet strategies, a
2026-06-12 · 15 min read #keycloak#oidc#jwt#sso#securityKeycloak 26 Architecture Deep Dive — Understanding Realms, Clients, and the Quarkus Runtime
A deep dive into the internal architecture of Keycloak 26.x. We cover the WildFly-to-Quarkus transition, the realm/client/role domain model, the authentication flow engine, kc.sh build optimization, and the new features
2026-06-12 · 16 min read #keycloak#sso#oidc#security#devopsThe Hard Problem of Single Logout (SLO) — Designing Front-Channel and Back-Channel Logout
In SSO, logout is harder than login. This post covers the three-layer session model, how OIDC RP-Initiated/Front-Channel/Back-Channel Logout work and where they fail, the logout token JWT structure, the realistic failure
2026-06-12 · 17 min read #sso#oidc#saml#keycloak#logoutRefresh Token Rotation and Session Management — Designing a Theft-Resistant Token Lifecycle
From access/refresh token lifetime design principles to rotation, reuse detection, and token family invalidation — we design a token lifecycle that assumes theft. We cover the three-layer model of IdP, app, and SSO sessi
2026-06-12 · 16 min read #oauth2#session#keycloak#security#ssoPasskeys Enterprise Rollout Guide — From WebAuthn/FIDO2 to Keycloak Integration
In 2026, passwordless authentication is no longer an experiment but the emerging default. This post dissects the WebAuthn registration/authentication ceremonies and attestation, walks through Keycloak 26 passkeys configu
2026-06-12 · 17 min read #passkeys#webauthn#fido2#keycloak#securitySSO Fundamentals — SAML vs OAuth 2.0 vs OIDC, What to Use and When
A complete walkthrough of how SSO works (IdP/SP/RP), sessions vs tokens, and the history and role differences of SAML, OAuth 2.0, and OIDC. Includes a protocol decision tree, comparison tables, and real authentication fl
2026-06-12 · 18 min read #sso#saml#oauth2#oidc#iamOAuth 2.1 Migration Guide — Designing Authentication in the Era of Mandatory PKCE
A deep dive into the known weaknesses of OAuth 2.0 and how the OAuth 2.1 draft consolidates RFC 6749, RFC 7636, and RFC 9700 into a single spec. We cover why Implicit and ROPC were removed, how PKCE works, refresh token
2026-06-12 · 17 min read #oauth2#oidc#security#pkce#ssoDissecting Symantec SiteMinder Architecture — The Standard of Legacy Enterprise WebSSO
A deep dive into SiteMinder, the product that dominated enterprise WebSSO for over two decades. We dissect the Policy Server, Web Agent, SMSESSION cookie, the realm/rule/policy object model, and the security implications
2026-06-12 · 17 min read #siteminder#sso#iam#security#webssoDesigning the Coexistence of Legacy WebSSO and Modern IAM — Architecture Patterns for the Hybrid Transition Era
The transition from legacy WebSSO to modern IAM lasts for years. We organize four coexistence patterns — protocol bridges, reverse-proxy header injection, identity orchestration, and the strangler fig — along with sessio
2026-06-12 · 18 min read #iam#sso#keycloak#siteminder#architectureSAML 2.0 Deep Dive — Mastering Assertions, Bindings, and Metadata
A dissection of SAML 2.0 with real XML examples: the structure of the Assertion at its heart, the AuthnRequest/Response flow, SP-initiated vs IdP-initiated SSO, HTTP-Redirect/POST/Artifact bindings, metadata exchange, an
2026-06-12 · 13 min read #saml#sso#xml#security#iamKeycloak SPI Extension Development — From Custom Authenticators to EventListeners
A complete guide to developing Keycloak SPI (Service Provider Interface) extensions. We cover the Provider/ProviderFactory architecture, a full internal SMS OTP Authenticator implementation, a Kafka audit-log EventListen
2026-06-12 · 13 min read #keycloak#spi#java#security#devopsKeycloak Identity Brokering — From Social Login to External IdP Federation
A practical guide to building Google/GitHub/Apple social login and external SAML/OIDC IdP federation with Keycloak Identity Brokering. Covers the first broker login flow, account linking with duplicate emails, attribute
2026-06-12 · 15 min read #keycloak#sso#oidc#saml#identity-brokeringDesigning SSO for Multi-Tenant SaaS — An Architecture for Enterprise Customer Onboarding
In B2B SaaS, supporting SSO means federating with each customer IdP. This post designs multi-tenant SSO end to end: realm-per-tenant vs Keycloak Organizations, email-domain home realm discovery, domain verification, JIT
2026-06-12 · 16 min read #sso#saas#keycloak#oidc#samlKeycloak LDAP/Active Directory Integration — A Practical Guide to User Federation ♪ Listenable
A hands-on guide to integrating LDAP and Active Directory with Keycloak User Federation, from architecture to production settings. Covers edit modes and sync strategies, AD-specific configuration, attribute mappers, perf
2026-06-12 · 21 min read #keycloak#ldap#active-directory#sso#security