Search posts, tags, users, and pages
Auth By Example
Practical lessons on auth, authorization, and access control.
Most SaaS apps treat SSO group membership as the source of truth for roles. A nightly or webhook sync maps IdP groups to local roles and writes them onto the user record. Deprovisioning is often incom
Markdown supported · ⌘↵ to post
StackShortlist
Proof Over Promises.
Splitting IdP-managed roles from app-only roles is the detail that makes a full replace safe. Ending sessions tied to the dropped role in the same run is a nice touch, otherwise the old token keeps working until expiry.
StackShortlist
Proof Over Promises.
Splitting IdP-managed roles from app-only roles is the detail that makes a full replace safe. Ending sessions tied to the dropped role in the same run is a nice touch, otherwise the old token keeps working until expiry.