Engineering
If you already understand OAuth clients, you already have most of what you need to understand agent authentication — which is both reassuring and slightly misleading. Reassuring, because an AI agent calling an API really is, structurally, a client requesting a token. Misleading, because the moment y
Engineering
There is a specific failure that no security architecture diagram contains.
Engineering
Lock the account after five failed attempts. It's in the hardening guide, the audit checklist, the framework, and the default configuration of nearly every directory product shipped in the last thirty years. Nobody defends it because nobody attacks it.
IAM
A few years ago, I was involved in evaluating an Identity and Access Management (IAM) platform for a SaaS application. The RFP was straightforward. Supports multi-tenancy. Every vendor answered Yes. The demos looked convincing. Implementation told a different story. One product required globally unique usernames. Another shared signing certificates across
SAML
A free browser extension that makes SAML failures easy to capture, understand, and share — built for the people who have to send the support ticket, not just the engineers who read it.
Troubleshoot faster. Share safely. Resolve with confidence. Every Identity Engineer Has Been Here A user reports: "I can't sign in." You know it's SAML. That's about all you know. Was the request never sent? Did the Identity Provider reject the request? Was
Implementing MFA
A hands-on report from adding SMS as a second factor to a live identity provider: 17 Java classes and two silent bugs on Keycloak vs. a single toggle on ClavionX.
If you've spent most of your career building web applications, learning Identity and Access Management (IAM) can feel surprisingly different. You might be an excellent Java developer. Or Python. Or Go. You may have built distributed systems, designed REST APIs, or deployed applications to Kubernetes. None of that
One thing that has always frustrated me about IAM administration is context switching. To understand a single tenant, I often end up opening multiple screens: • Configuration • Policies • Federation settings • Audit logs • Monitoring dashboards • Dependencies By the time I have all the information, I've almost forgotten what I was
Identity & Access Management
Every authentication failure is a broken promise. Here is why identity infrastructure is so hard to get right — and what we built to fix it.