SSO with MFA – SaaS Service
MFA Before Full Access: A Secure User Onboarding Flow SSO with MFA – for SaaS Services Q1: If a SaaS service supports SSO, does…
Read the articleBlog
Notes on identity architecture, federation and cloud access — written from the work itself.
Isolating Browser Sessions – In the Cloud and Locally
Browser Isolation Options for Whitelisted Site Access
Read the articleSAML-Based SSO: Source IP for IdP and SP Initiated Flows
SAML-Based SSO: Source IP for IdP and SP Initiated Flows SP-Initiated SSO Flow Summary: The user starts at the Service Provider (SP), which redirects…
Read the articleCapturing a Second Factor Before Full Trust
MFA Before Full Access: A Secure User Onboarding Flow Capturing a Second Factor Before Full Trust: A Smarter Onboarding Flow In most traditional account…
Read the articleEnforcing a Second Factor in Entra ID: How to Secure Users Who Never Had One
Enforcing a Second Factor in Entra ID: How to Secure Users Who Never Had One If a user isn’t using a second factor, they’re…
Read the articleInbound versus Outbound SSO
? Inbound SSO (Single Sign-On) Definition:Inbound SSO means users from an external identity provider (IdP) can sign into your application or service using their…
Read the articleOAuth – a primer
Understanding OAuth: Client Types, Flows, and Key Concepts OAuth is the backbone of modern API security, enabling controlled access to resources without sharing user…
Read the articleTwo OAuth Flows – Public and Private
Public vs. Confidential OAuth Clients and Flows Public Flow – Through the Browser, Token returned to the browser. Implicit Grant Flow Private/Confidential Clients (Backend…
Read the articleBearer Tokens Based Authentication
Bearer Token–Based API Authentication and Authorization Bearer tokens are widely used to protect APIs. After a client obtains an access token from an authorization…
Read the articlePrivate Key JWT Authentication
Private Key JWT Authentication Private Key JWT—usually identified by the OAuth client-authentication method name private_key_jwt—allows an application to authenticate using asymmetric cryptography instead of…
Read the article