9 min readBackendFeatured
Automating Access Reviews with Keycloak and Spring Boot
Learn how to automate access certification processes with Keycloak and Spring Boot for better compliance and identity governance.
Blog
Writing on Identity & Security
Practical guides on OAuth 2.0, OpenID Connect, SAML, Keycloak, and the platform engineering behind identity systems.
Top tags (25)
#authentication77#security75#oauth242#keycloak33#identity-management30#spring-security24#oidc20#api-security19#access-control16#web-security15#saml13#spring-boot13#zero-trust13#cloud-security11#devsecops11#java11#jwt10#security-architecture10#sso10#backend9#cybersecurity8#authorization7#aws7#identity7#identity-security7View all →
221 posts · page 5 of 12
12 min readBackendFeatured
Identity Resilience Testing: Chaos Engineering for IAM Systems
Learn how to apply chaos engineering principles to IAM systems. This guide covers failure injection, Keycloak chaos testing, and strategies for SRE identity resilience.
8 min readBackendFeatured
Building Secure Micro-Frontends with OIDC and Token Mediation
Explore how to implement effective security in micro-frontend architectures using OIDC and token isolation mechanisms.
Part 3 · Frontend Security Architecture
10 min readBackendFeatured
Understanding OAuth 2.0 Rich Authorization Requests (RAR)
Explore how OAuth 2.0 Rich Authorization Requests (RAR) enable fine-grained authorization through RFC 9396.
Part 1 · OAuth 2.0 & OIDC Mastery Series
10 min readtechnicalFeatured
Workforce vs Customer Identity (CIAM): Implementation Guide
Explore the critical differences between workforce identity and customer identity management, focusing on implementation strategies for B2B and B2C scenarios.
9 min readtechnicalFeatured
Privacy-Enhancing Technologies for Privacy Identity Management
Explore how privacy-preserving authentication methods, including zero-knowledge proofs and anonymous credentials, transform identity management while ensuring GDPR compliance.
9 min readBackendFeatured
Building an Identity-Aware API Gateway with Kong and OIDC
Learn how to implement effective identity-aware authentication in your API gateway using Kong, OIDC, and JWT plugins.
8 min readBackendFeatured
Common OAuth2 Implementation Mistakes and How to Avoid Them
Learn to avoid critical OAuth2 implementation errors and security anti-patterns by applying practical guidance for secure authentication flows.
11 min readtechnicalFeatured
Implementing Just-in-Time Provisioning with SAML and OIDC
Learn how to implement just-in-time provisioning workflows leveraging SAML, OIDC, and SCIM to automate user creation and synchronization across platforms.
Part 1 · Identity & Access Management Series
8 min readTechnicalFeatured
Identity-First Security: Shifting to Identity Perimeter
Learn how identity-first security redefines the perimeter, enabling strong zero trust architectures in modern distributed environments.
7 min readtechnicalFeatured
AI in Identity Security: Opportunities & Risks
Explore how AI transforms identity security. This analysis covers machine learning IAM, fraud detection, deepfake defense, and authentication challenges facing advanced systems.
9 min readtechnicalFeatured
Building Resilient Authentication: Failover and Disaster Recovery for IAM
Learn how to build resilient authentication systems with effective failover mechanisms and disaster recovery planning for Keycloak HA environments.
11 min readtechnicalFeatured
SAML Metadata Signature Validation: Preventing Metadata Spoofing
How to validate SAML metadata signatures to stop attackers from spoofing identity providers and compromising your security infrastructure.
10 min readtechnicalFeatured
IAM Metrics: Measuring Security Effectiveness
Learn how to measure security effectiveness using IAM metrics, access review metrics, and identity governance metrics to optimize your security posture.
9 min readtechnicalFeatured
Implementing Attribute-Based Access Control (ABAC) with Spring Security
Learn how to build dynamic authorization logic with ABAC, Spring Security, OPA, and Rego policies for fine-grained access control in Java applications.
10 min readBackendFeatured
OAuth2 Device Grant: IoT & CLI Auth (RFC 8628)
Learn how the OAuth2 Device Authorization Grant enables secure authentication for headless IoT devices and command-line interfaces.
Part 1 · OAuth2 Security Series
7 min readtechnicalFeatured
Designing a Centralized Identity Platform: Lessons Learned
Explore real-world insights on designing a centralized identity platform, including IAM evaluation techniques and strategic architecture decisions.
8 min readBackendFeatured
Credential Stuffing and Account Takeover Prevention
Advanced techniques for defending against credential stuffing and preventing account takeovers through effective login security measures.
8 min readBackendFeatured
Identity Federation Patterns: Multi-Cloud Identity Management
Explore essential identity federation patterns for managing identities across AWS, Azure, and GCP. This guide covers multi-cloud identity strategies and cross-cloud security best practices.
Part 3 · Multi-Cloud Security Architecture Series
7 min readtechnicalFeatured
Understanding OAuth 2.0 Pushed Authorization Requests (PAR)
Learn how Pushed Authorization Requests (PAR) defined in RFC 9126 improve OAuth 2.0 security and mitigate the risk of authorization code interception.
Part 3 · OAuth 2.0 Security