Enterprise Sector
Engineering the Core Identity Framework
A reference build: one zero-trust identity authority federating a group's inherited directories, so offboarding somebody takes one action instead of eighteen.
Design targets, not measured results
5k/sAuth throughput target
OIDCFederation across legacy directories
0Standing long-lived credentials
The Identity Sprawl
The brief: a group that had acquired its way into eighteen directory domains, where an average employee needed six sets of credentials to do their job. Password fatigue is not a user education problem at that point. It is an architecture producing shadow IT on purpose.
- warningPerimeter security defeated by the people it was protecting.
- warningNo single action that reliably removes a leaver from everything.
Federation & Unification
A central authority that trusts nothing by default, including itself, and that can be adopted one system at a time, because a big-bang identity cutover is how companies lose a Monday.
key
Identity Federation
Mapping directory and LDAP schemas that disagree about what a person is into one identity graph, with the conflicts resolved explicitly rather than by last-write-wins.
policy
Adaptive Risk Policies
Scoring on IP, device posture and behaviour before granting access, plus a documented answer for what happens when the score is wrong, which is the part most designs skip.
cable
Standards, Not Adapters
Everything speaks OpenID Connect. Anything that cannot is put behind a proxy that can, so there is exactly one integration pattern to maintain.
Build Sequence
Build Sequence
01 / 03
Phase 1: The Core Broker
A central identity provider sized for group-wide peak rather than average, because auth load is a Monday-morning spike, and an identity service that degrades under it takes everything else with it.
02 / 03
Phase 2: Legacy Bridging
Reverse proxies in front of on-premise applications that will never speak SAML or OIDC, so the estate can migrate without waiting for its oldest system.
03 / 03
Phase 3: Rollout & Deprecation
Directory by directory, with the old path live until the new one has carried real traffic. Rollback stays available at every step, and the legacy domain is switched off last.
Distributed Zero-Trust Authority
Lightweight identity gateways at the edge over a distributed cluster, so authentication latency does not track distance from head office. Every request is explicitly validated and signed, including the ones already inside the network, which are the ones that matter.
Technology Stack
Node.jsOAuth 2.0OIDCRedisTerraform
EDGE API GATEWAY
AUTH
ROUTING
DATA
DISTRIBUTED CLUSTER
Other reference builds
View All arrow_forwardRecognise your own system in this?
Then the next useful thing is forty-five minutes and a written brief on yours. Same format as this page, your constraints, and yours to keep either way.