Essays & proud scars
The identity zoo and four questions about any token Identity
An engineer once asked me what the hell a bearer token is, and I remembered asking the same thing. The answer is four questions that work for any token: what does it say, who is it for, how long does it live, who can take it back. Purpose first. The format follows.
SSO For Integrations, For the Decision Maker Identity
The decision half of a two-part guide to cross-application single sign-on: why bare OAuth is not on the list, where the flow starts and why the response matters more, the table that picks SP-initiated, SAML IdP-initiated, OIDC third-party-initiated login or a signed handoff, consent, single logout, the account contract, and the questions to bring to the planning meeting. No code; the mechanics are in the companion post.
SSO For Integrations, For the One who's Building it Identity
The mechanics half of a two-part guide to cross-application single sign-on: the callback handler and the four doors it closes, the cross-site POST and SameSite, hardening an unsolicited SAML response, OIDC section 4, the launch token, back-channel logout, home realm discovery without enumeration, linking identifiers, certificate rotation, the redirect loop, the clock, logging, and twenty-six tests.
No credentials means none. I halted a project over it. Leadership
More than six months into building passwordless login for the employees of one of the largest technology companies in the world, on their work laptops, we found the one place a credential still had to exist. It might never have been caught. Here is why we halted it anyway, until the foundations were ready, and what happened when I said so.
A development center from zero Leadership
A company whose customers ran million-dollar machines needed engineers on the customer's clock, not its own. I was sent to build that, from an operations office in Tucson with no engineers in it. What it took, what it cost, and what I would do differently.
The deadline was game one Leadership
In 2018, four engineers and I had a few months to make a CDN do something it had never done, for the NBA Finals. Here is what the project taught me, including the parts I only understood much later.
In the critical path of evolution Leadership
Reorganizations land hardest on the teams that sit in the critical path of everything. Identity is the clearest example. What I learned, from both sides of the chart.
Write the exam, write the answer key, then sit the exam: why dogfooding really, really matters Engineering
I built a learning platform with two CI gates and a few thousand assertions, and it still shipped four exercises that failed even when I got the right answer. The missing ingredient wasn't more tests. It was dogfooding, and knowing when to stop.
Get the next one by email.
When the writing earns it. No tracking, unsubscribe anytime.