Tag: #security
Writing on GPUs, LLMs, MLOps, Kubernetes — and mindset · 141 posts
The Hard Problem of Single Logout (SLO) — Designing Front-Channel and Back-Channel Logout
In SSO, logout is harder than login. This post covers the three-layer session model, how OIDC RP-Initiated/Front-Channel/Back-Channel Logout work and where they fail, the logout token JWT structure, the realistic failure
2026-06-12 · 17 min read #sso#oidc#saml#keycloak#logoutRefresh Token Rotation and Session Management — Designing a Theft-Resistant Token Lifecycle
From access/refresh token lifetime design principles to rotation, reuse detection, and token family invalidation — we design a token lifecycle that assumes theft. We cover the three-layer model of IdP, app, and SSO sessi
2026-06-12 · 16 min read #oauth2#session#keycloak#security#ssoPasskeys Enterprise Rollout Guide — From WebAuthn/FIDO2 to Keycloak Integration
In 2026, passwordless authentication is no longer an experiment but the emerging default. This post dissects the WebAuthn registration/authentication ceremonies and attestation, walks through Keycloak 26 passkeys configu
2026-06-12 · 17 min read #passkeys#webauthn#fido2#keycloak#securitySSO Fundamentals — SAML vs OAuth 2.0 vs OIDC, What to Use and When
A complete walkthrough of how SSO works (IdP/SP/RP), sessions vs tokens, and the history and role differences of SAML, OAuth 2.0, and OIDC. Includes a protocol decision tree, comparison tables, and real authentication fl
2026-06-12 · 18 min read #sso#saml#oauth2#oidc#iamOAuth 2.1 Migration Guide — Designing Authentication in the Era of Mandatory PKCE
A deep dive into the known weaknesses of OAuth 2.0 and how the OAuth 2.1 draft consolidates RFC 6749, RFC 7636, and RFC 9700 into a single spec. We cover why Implicit and ROPC were removed, how PKCE works, refresh token
2026-06-12 · 17 min read #oauth2#oidc#security#pkce#ssoDissecting Symantec SiteMinder Architecture — The Standard of Legacy Enterprise WebSSO
A deep dive into SiteMinder, the product that dominated enterprise WebSSO for over two decades. We dissect the Policy Server, Web Agent, SMSESSION cookie, the realm/rule/policy object model, and the security implications
2026-06-12 · 17 min read #siteminder#sso#iam#security#webssoDesigning the Coexistence of Legacy WebSSO and Modern IAM — Architecture Patterns for the Hybrid Transition Era
The transition from legacy WebSSO to modern IAM lasts for years. We organize four coexistence patterns — protocol bridges, reverse-proxy header injection, identity orchestration, and the strangler fig — along with sessio
2026-06-12 · 18 min read #iam#sso#keycloak#siteminder#architectureSAML 2.0 Deep Dive — Mastering Assertions, Bindings, and Metadata
A dissection of SAML 2.0 with real XML examples: the structure of the Assertion at its heart, the AuthnRequest/Response flow, SP-initiated vs IdP-initiated SSO, HTTP-Redirect/POST/Artifact bindings, metadata exchange, an
2026-06-12 · 13 min read #saml#sso#xml#security#iamKeycloak SPI Extension Development — From Custom Authenticators to EventListeners
A complete guide to developing Keycloak SPI (Service Provider Interface) extensions. We cover the Provider/ProviderFactory architecture, a full internal SMS OTP Authenticator implementation, a Kafka audit-log EventListen
2026-06-12 · 13 min read #keycloak#spi#java#security#devopsKeycloak Identity Brokering — From Social Login to External IdP Federation
A practical guide to building Google/GitHub/Apple social login and external SAML/OIDC IdP federation with Keycloak Identity Brokering. Covers the first broker login flow, account linking with duplicate emails, attribute
2026-06-12 · 15 min read #keycloak#sso#oidc#saml#identity-brokeringOAuth Token Exchange (RFC 8693) — The Definitive Guide to Delegation and Propagation in Microservices
How to solve the token propagation problem between microservices with RFC 8693 Token Exchange. Covers the difference between impersonation and delegation, request and response parameters, standard support in Keycloak 26.
2026-06-12 · 15 min read #oauth2#keycloak#oidc#security#microservicesDesigning SSO for Multi-Tenant SaaS — An Architecture for Enterprise Customer Onboarding
In B2B SaaS, supporting SSO means federating with each customer IdP. This post designs multi-tenant SSO end to end: realm-per-tenant vs Keycloak Organizations, email-domain home realm discovery, domain verification, JIT
2026-06-12 · 16 min read #sso#saas#keycloak#oidc#samlKeycloak LDAP/Active Directory Integration — A Practical Guide to User Federation
A hands-on guide to integrating LDAP and Active Directory with Keycloak User Federation, from architecture to production settings. Covers edit modes and sync strategies, AD-specific configuration, attribute mappers, perf
2026-06-12 · 21 min read #keycloak#ldap#active-directory#sso#securityOIDC Token Validation at the API Gateway — Istio, Envoy, and Gateway API in Practice
Validate at the edge or in the service? This post covers detailed Envoy jwtauthn filter configuration, the Istio RequestAuthentication plus AuthorizationPolicy combination, JWKS caching and failure modes, audience strate
2026-06-12 · 15 min read #istio#envoy#jwt#oidc#api-gatewayAdvanced OAuth Flows — When You Need CIBA, Device Flow, and DPoP
A guide to advanced OAuth mechanisms for authentication scenarios that the standard redirect flow cannot solve. Covers the Device Authorization Grant (RFC 8628), CIBA with its poll/ping/push modes, the DPoP (RFC 9449) pr
2026-06-12 · 15 min read #oauth2#oidc#keycloak#ciba#dpopMastering JWT Security — Signature Verification, Key Rotation, and Common Vulnerabilities
We dissect the structure of JWT, JWS, and JWE and cover real-world vulnerabilities such as alg confusion attacks and kid injection, along with their defenses. From JWKS-based key rotation and algorithm selection includin
2026-06-12 · 16 min read #jwt#security#oidc#keycloak#cryptographyThe Hands That Build Surveillance — Developer Ethics and Privacy Engineering
From the Larry Ellison remark about constant recording, to the walking tour of surveillance infrastructure in Seattle, to mandatory age verification — the 2026 surveillance debate ultimately plays out in the hands of the
2026-06-12 · 21 min read #privacy#ethics#surveillance#engineering#cultureKeycloak Authorization Services — Fine-Grained Access Control with UMA 2.0
A deep dive into Keycloak Authorization Services that goes beyond the limits of RBAC. Covers the resource/scope/policy/permission model, the UMA 2.0 grant flow, policy enforcer configuration, decision strategies, and how
2026-06-12 · 16 min read #keycloak#authorization#uma#oauth2#security2026 IAM Trends — AI Agent Identity, MCP Authentication, Verifiable Credentials
The 2026 IAM landscape is being reshaped by passwordless-by-default, an explosion of non-human identities in the form of AI agents, and the OAuth 2.1-based standardization of MCP authorization. From on-behalf-of delegati
2026-06-12 · 16 min read #iam#oauth2#mcp#ai-agent#keycloakBuilding MCP Servers in Practice — How to Connect Your Tools to Every AI Agent
A hands-on guide to building MCP (Model Context Protocol) servers, the de facto standard of 2026. We implement an internal wiki search server in TypeScript and Python, and cover tool design principles, OAuth 2.1 authenti
2026-06-12 · 17 min read #mcp#ai-agent#typescript#python#oauth2