Engineering
This is the most violated boundary in the whole category, and it's violated for the most sympathetic reason: the identity platform already has a table with a row for every person, and you need somewhere to put a field.
Engineering
Every identity vendor supports SAML, OIDC, SCIM, MFA, and audit logging. Every one of them will tick every box on your RFP. Every one has a page that says "enterprise-grade" and a diagram with a shield on it.
Engineering
These three terms get used interchangeably often enough that it's worth being precise about why that's a problem: they solve different problems, and picking the wrong one doesn't just mean using suboptimal terminology — it means building something insecure while feeling confident it's secure.
Engineering
I had two conversations in the same week that turned out to be the same conversation.
Engineering
Here's a question worth asking your team today, while nothing is on fire:
Engineering
The request arrives, in every enterprise deal, in almost identical words:
Engineering
SAML errors are uninformative on purpose, and knowing why is the first step to debugging them.
Engineering
The first if (customer == "ACME") is free.
Engineering
You won the argument. It took two quarters, a written proposal, and a meeting where you walked the security team through the research: rotation trains users to increment a digit, it drives helpdesk volume, it conditions people to comply with unexpected "change your password now" prompts. NIST agrees
Engineering
The requirement arrives from your security team looking entirely reasonable. Users shouldn't be allowed to set a password that's already appeared in a breach.
Engineering
Look at the feature list of any major identity platform from ten years ago and compare it to today. Authentication, federation, tokens, sessions — all still there. But now there's also bot detection. IP reputation scoring. Rate limiting. Geo-blocking. Threat intelligence feeds. Fraud signals. CAPTCH
Engineering
The first time I explained our identity architecture to a platform engineer, I was three diagrams in and losing them. Then I said "it's basically Kubernetes," and they got the entire thing in about fifteen seconds.