Identity & Access
12 guides · 23 glossary terms
Identity is usually the largest line in a security budget and the one most likely to be built twice. These guides cover the protocol choices that lock you in, the authorization models people conflate, the implementation work for SSO, passkeys, and SCIM, and the runbooks for leaving a platform without downtime.
Start here
How to Choose a CIAM Platform
Do not pick CIAM from a logo grid. Decide whether you need it, score five questions that discriminate, bake off four flows, and know when to stay.
Explainers
All explainers→OAuth 2.0 vs OIDC vs SAML
intro · 8 minOAuth 2.0 is authorization, OIDC adds authentication, and SAML is enterprise federation. Here is what each actually does, the token types, and a decision table for when to use which.
RBAC vs ABAC vs ReBAC vs PBAC
practitioner · 9 minThe four authorization models compared: RBAC (role), ABAC (attributes), ReBAC (relationship), PBAC (policy). What each is, where each breaks, and a decision table for choosing.
How-To & Implementation
All how-to & implementation→Add SSO to Your B2B SaaS (and Escape the SSO Tax)
practitioner · 9 minEnterprise deals stall without SSO. Here is how to add SAML and OIDC single sign-on the right way, model it multi-tenant, and price it without the SSO tax.
Implement Passkeys / WebAuthn (with code)
practitioner · 8 minA working guide to passkeys and WebAuthn: the ceremony, real server and browser code, synced vs device-bound tradeoffs, and the recovery design that makes or breaks it.
Set Up SCIM Provisioning for Enterprise Customers
practitioner · 8 minHow to implement SCIM 2.0: the User and Group schema, the endpoints you must build, deactivate-not-delete flows, group-to-role mapping, and testing against Okta and Entra.
Deepfake Executive Fraud: The Controls That Actually Work
intro · 9 minAssume the voice, face, and story are perfect. The controls that still hold are process controls: out-of-band callback, dual authorization, a slow vendor-detail workflow, and a blameless stop.
Migration
All migration→Migrate Off Akamai Identity Cloud Before the Deadline
practitioner · 8 minA runbook for moving off Akamai Identity Cloud (formerly Janrain) before end-of-life: inventory, bulk export, just-in-time password migration, a staged cutover with rollback, and the user-comms plan.
Migrate Off Auth0 Without Downtime
practitioner · 8 minA zero-downtime runbook for leaving Auth0: what is portable, trickle vs bulk migration, bcrypt hash export, Rules/Actions remapping, coexistence cutover, and rollback.
Replace Supabase Auth Without Moving Your Database
practitioner · 9 minSupabase supports external JWT issuers, so you can swap auth providers and keep Postgres, RLS, Storage, and Realtime untouched. The four hard requirements, the bcrypt export, and Auth0 versus MojoAuth.
Teardowns
All teardowns→Why Passwords Fail (and What to Ship Instead)
intro · 8 minA shared secret you can type is a secret an attacker can replay. What actually breaks, what does not fix it, and the order to replace passwords.
SMS MFA Is Not MFA
intro · 7 minNIST restricted SMS as an authenticator in 2017. SIM swaps and real-time phishing are why. What to rip out, and what to put in.
Vocabulary
Short, citable definitions for the terms these guides assume.