A practical look at identity, sessions, OAuth 2.0, OpenID Connect, and tenant isolation. Single...
A practical look at identity, sessions, OAuth 2.0, OpenID Connect, and tenant isolation.
Single Sign-On is often summarized as "log in once and access many applications." That is correct, but incomplete. A real SSO system must also answer several security questions:
Which application is requesting access?
Which organization owns that application?
Is the user allowed to use it?
Single sign-on means trusting the identity provider. We trusted it for one thing too many: we resolved returning federated users…
"Security isn't a feature you add at the end. It's the foundation you build everything else on top...
Quick Summary (Key Takeaways) Multi-tenancy lets one SaaS platform serve multiple...
Most apps think they are secure because they have login pages. But authentication is only the first...
August 2025. Attackers compromise OAuth tokens inside Salesloft's Drift platform. Those tokens carry...
In Part 1, we implemented Application-Level Envelope Encryption. Our documents are now protected by...
