Blog
Writing on GPUs, LLMs, MLOps, Kubernetes — and mindset · 3517 posts
#2026-03 765#english 592#culture 264#deep-dive 254#kubernetes 247#career 229#ai 216#llm 208#devops 193#2026-04 146#security 141#database 114#observability 113#communication 109#history 107#architecture 100#productivity 96#finance 88#economy 84#mindset 81#psychology 80#ai-papers 79#food 78#it 78#travel 78#deep-learning 77#japanese 77#networking 77#performance 72#business-travel 70#linux 70#gpu 69#ai-agent 66#cs-fundamentals 63#postgresql 60#rag 58#self-improvement 55#learning 53#mlops 53#ai-platform 51
Refresh Token Rotation and Session Management — Designing a Theft-Resistant Token Lifecycle
From access/refresh token lifetime design principles to rotation, reuse detection, and token family invalidation — we design a token lifecycle that assumes theft. We cover the three-layer model of IdP, app, and SSO sessi
2026-06-12 · 16 min read #oauth2#session#keycloak#security#ssoPasskeys Enterprise Rollout Guide — From WebAuthn/FIDO2 to Keycloak Integration
In 2026, passwordless authentication is no longer an experiment but the emerging default. This post dissects the WebAuthn registration/authentication ceremonies and attestation, walks through Keycloak 26 passkeys configu
2026-06-12 · 17 min read #passkeys#webauthn#fido2#keycloak#securitySSO Fundamentals — SAML vs OAuth 2.0 vs OIDC, What to Use and When
A complete walkthrough of how SSO works (IdP/SP/RP), sessions vs tokens, and the history and role differences of SAML, OAuth 2.0, and OIDC. Includes a protocol decision tree, comparison tables, and real authentication fl
2026-06-12 · 18 min read #sso#saml#oauth2#oidc#iamOAuth 2.1 Migration Guide — Designing Authentication in the Era of Mandatory PKCE
A deep dive into the known weaknesses of OAuth 2.0 and how the OAuth 2.1 draft consolidates RFC 6749, RFC 7636, and RFC 9700 into a single spec. We cover why Implicit and ROPC were removed, how PKCE works, refresh token
2026-06-12 · 17 min read #oauth2#oidc#security#pkce#ssoDissecting Symantec SiteMinder Architecture — The Standard of Legacy Enterprise WebSSO
A deep dive into SiteMinder, the product that dominated enterprise WebSSO for over two decades. We dissect the Policy Server, Web Agent, SMSESSION cookie, the realm/rule/policy object model, and the security implications
2026-06-12 · 17 min read #siteminder#sso#iam#security#webssoDesigning the Coexistence of Legacy WebSSO and Modern IAM — Architecture Patterns for the Hybrid Transition Era
The transition from legacy WebSSO to modern IAM lasts for years. We organize four coexistence patterns — protocol bridges, reverse-proxy header injection, identity orchestration, and the strangler fig — along with sessio
2026-06-12 · 18 min read #iam#sso#keycloak#siteminder#architectureSAML 2.0 Deep Dive — Mastering Assertions, Bindings, and Metadata
A dissection of SAML 2.0 with real XML examples: the structure of the Assertion at its heart, the AuthnRequest/Response flow, SP-initiated vs IdP-initiated SSO, HTTP-Redirect/POST/Artifact bindings, metadata exchange, an
2026-06-12 · 13 min read #saml#sso#xml#security#iamKeycloak SPI Extension Development — From Custom Authenticators to EventListeners
A complete guide to developing Keycloak SPI (Service Provider Interface) extensions. We cover the Provider/ProviderFactory architecture, a full internal SMS OTP Authenticator implementation, a Kafka audit-log EventListen
2026-06-12 · 13 min read #keycloak#spi#java#security#devopsProperty-Based Testing in Practice — Catching the Bugs Examples Cannot
A practice-first guide to property-based testing (PBT), which catches the bugs that example-based tests miss. Covers the core concepts of properties, generators, and shrinking, a pattern catalog for discovering propertie
2026-06-12 · 17 min read #testing#property-based-testing#hypothesis#jqwik#fast-checkKeycloak Identity Brokering — From Social Login to External IdP Federation
A practical guide to building Google/GitHub/Apple social login and external SAML/OIDC IdP federation with Keycloak Identity Brokering. Covers the first broker login flow, account linking with duplicate emails, attribute
2026-06-12 · 15 min read #keycloak#sso#oidc#saml#identity-brokeringOAuth Token Exchange (RFC 8693) — The Definitive Guide to Delegation and Propagation in Microservices
How to solve the token propagation problem between microservices with RFC 8693 Token Exchange. Covers the difference between impersonation and delegation, request and response parameters, standard support in Keycloak 26.
2026-06-12 · 15 min read #oauth2#keycloak#oidc#security#microservicesDesigning SSO for Multi-Tenant SaaS — An Architecture for Enterprise Customer Onboarding
In B2B SaaS, supporting SSO means federating with each customer IdP. This post designs multi-tenant SSO end to end: realm-per-tenant vs Keycloak Organizations, email-domain home realm discovery, domain verification, JIT
2026-06-12 · 16 min read #sso#saas#keycloak#oidc#samlKeycloak + Spring Security 6 Integration — Resource Server and OAuth2 Client in Practice
A practical guide to integrating Keycloak with Spring Security 6 as an OAuth2 Resource Server and Client. Covers issuer-uri auto-configuration, mapping realm and client roles with JwtAuthenticationConverter, OIDC logout,
2026-06-12 · 11 min read #keycloak#spring-security#oauth2#oidc#jwtKeycloak LDAP/Active Directory Integration — A Practical Guide to User Federation
A hands-on guide to integrating LDAP and Active Directory with Keycloak User Federation, from architecture to production settings. Covers edit modes and sync strategies, AD-specific configuration, attribute mappers, perf
2026-06-12 · 21 min read #keycloak#ldap#active-directory#sso#securityOIDC Token Validation at the API Gateway — Istio, Envoy, and Gateway API in Practice
Validate at the edge or in the service? This post covers detailed Envoy jwtauthn filter configuration, the Istio RequestAuthentication plus AuthorizationPolicy combination, JWKS caching and failure modes, audience strate
2026-06-12 · 15 min read #istio#envoy#jwt#oidc#api-gatewayAdvanced OAuth Flows — When You Need CIBA, Device Flow, and DPoP
A guide to advanced OAuth mechanisms for authentication scenarios that the standard redirect flow cannot solve. Covers the Device Authorization Grant (RFC 8628), CIBA with its poll/ping/push modes, the DPoP (RFC 9449) pr
2026-06-12 · 15 min read #oauth2#oidc#keycloak#ciba#dpopKeycloak HA on Kubernetes — Infinispan Clustering and Zero-Downtime Deployments
A hands-on guide to running Keycloak with high availability on Kubernetes. We compare the Operator and Helm, walk through Infinispan caches and JGroups DNSPING, persistent user sessions, the 26.6 zero-downtime rolling pa
2026-06-12 · 13 min read #keycloak#kubernetes#infinispan#ha#devopsMastering JWT Security — Signature Verification, Key Rotation, and Common Vulnerabilities
We dissect the structure of JWT, JWS, and JWE and cover real-world vulnerabilities such as alg confusion attacks and kid injection, along with their defenses. From JWKS-based key rotation and algorithm selection includin
2026-06-12 · 16 min read #jwt#security#oidc#keycloak#cryptographyThe Art of the S-Tier Demo — For Developers Who Build but Never Show
From why the PostHog How to demo essay struck a nerve, to the structure of an S-tier demo that opens with a 15-second hook, scenario scripting, demo-mode flags in code, and ten common failures with recovery lines. A prac
2026-06-12 · 22 min read #demo#communication#career#presentation#developer-productivityDuckDB in Practice — The Era of Embedded Analytics That Ends on Your Laptop
Why is DuckDB, often called the SQLite of OLAP, so loved? We start from the architecture and cover direct Parquet querying, hands-on examples of window functions, PIVOT, and ASOF JOIN, zero-copy integration with pandas,
2026-06-12 · 14 min read #duckdb#database#olap#analytics#parquet