Identity and security
Authentication, authorisation and the protocols behind them, including OAuth, OpenID Connect and SAML.
Identity is how a system knows who is using it, and security is how it makes sure they can only do what they’re allowed to. The two underpin every B2B SaaS product, and they’re often where legacy systems show their age.
I’ve designed authentication and permission models for multi-tenant platforms, integrated with enterprise single sign-on through SAML and OpenID Connect, and worked through the trade-offs between the protocols. In modernisation projects the shared login between old and new parts of a product is usually one of the first problems to solve.
Security done well is mostly unglamorous. Sensible defaults, clear permissions, and the discipline to keep them that way.
Related Content
OAuth
A short, practical guide to OAuth 2.0. What it does, what it doesn't do, how OpenID Connect fits on top.
SAML vs OAuth
A short, practical guide to SAML. How it works, who uses it, what the certificates are for, and why it's a different thing from OAuth.
Modernising an insurance platform without a rewrite
How a fast-growing insurance marketplace moved from server-rendered pages to React and a structured API, one page at a time, while still shipping features to show investors.