Technical guidance for teams designing, operating, and upgrading self-hosted customer identity.
Database support is not usually the headline feature in an identity platform. It becomes important when the platform team has to operate it for years. ProAuth v3 changes that operational baseline in a few concrete ways. It supports SQL...
Read the latest analysisFilter by the work in front of you: release planning, protocol security, architecture, operations, or product capability.
Database support is not usually the headline feature in an identity platform. It becomes important when the platform team has to operate it for years. ProAuth v3 changes...
Custom authentication views sit close to the trust boundary. They render login forms, MFA prompts, error messages, identity provider choices, consent pages, and the...
Long lived identity automation has a habit of outgrowing the API contract it started with. At first, a broad update endpoint is convenient. Read a DTO, change the fields...
ProAuth 3.0.0 is available today, 2026 07 08. This is a major platform release, not a maintenance patch. Compared to ProAuth 2.2.12, which focused on Helm v4...
Major version upgrades are easiest to underestimate when the application still looks familiar from the outside. ProAuth v3 is one of those upgrades where the operating...
Token format is not a cosmetic detail. It decides who can read claims, where validation happens, how quickly revocation becomes visible, and what a resource server must...
The user may not notice the difference. They click Sign in . They land on the same product screen. They load profile data and call an API. From the front of the house, a...
The talk on 2026 06 30 was not about replacing OAuth or OpenID Connect. That is an important starting point, because identity protocol discussions can quickly turn into...
Passwords are not going to disappear from enterprise systems because one feature flag changes. They disappear when the surrounding login model is ready: the domain is...
High assurance OAuth does not usually fail because one engineer forgot the name of a standard. It fails in smaller, more ordinary ways. A client is allowed to send a...
Client secrets are useful until they become the thing everyone knows how to copy. That is the quiet risk in many OAuth deployments. A shared secret starts in the client...
Bearer tokens fail in a very plain way: if someone can copy the token, they can often replay it. That does not mean every bearer token deployment is careless. Short...
Authorization requests are easy to underestimate because they happen before the token exists. In a conventional authorization code flow, the application sends a long...
Non human access is where vague identity language becomes security debt. "Machine to machine" can mean a backend service calling an internal API on its own behalf. It...
Bearer tokens are popular for a reason. They are simple to issue, simple to send, and simple for an API to validate. The client presents the token, the resource server...
Most SPA security discussions still start with the wrong question. The question is not whether a browser application can use OAuth. Modern browser applications can use...
Most OAuth and OpenID Connect mistakes in mature systems are not exotic. They come from old defaults that stayed in place after the guidance moved on: implicit flow in...
Authentication is usually the first dependency every other service discovers during an incident. An application can degrade when a reporting job is down. A background...
Identity configuration is production behavior. A changed redirect URI can break login. A new client secret can open a path that was not reviewed. A modified claim rule...
Certificate rotation rarely fails at the moment someone creates a new certificate. It fails in the gap between systems: one service starts signing with a new key,...
Customer onboarding often starts with a small identity change: add a tenant, register a federated identity provider, upload a customer logo, activate provisioning. In...
Not every customer is ready for enterprise single sign on on day one. Some customers arrive with a mature identity team, an OpenID Connect or ADFS setup, approval...
MFA becomes harder to manage when every tenant has the same login policy on paper but a different risk profile in practice. One customer may require MFA for every user...
Federation solves the login problem. It lets a SaaS application redirect a user to the customer's identity provider, receive the result through ProAuth, and keep the...
Tenant identification is easy to treat as a routing detail. In practice, it is one of the first product decisions in an enterprise SaaS login flow. Before ProAuth can...
Federation solves the login problem, but it does not automatically solve the application contract problem. Two enterprise customers can both use OpenID Connect and still...
SaaS authentication becomes expensive when every service carries its own customer specific logic. One API checks a local user table. Another understands a specific...
Why do we need directory synchronization? ProAuth is optimized to be used in a multi tenant context. This is often the case if you are providing a SaaS application to...
Why view customizations? Company branding is important for SaaS applications. Your customers often like to have their corporate identity throughout the applications they...
Why multi tenancy and single sign on? If you are running a SaaS application, you are likely interested in integrating your customers as seamlessly as possible. The...
No articles match that filter yet.