#sso
2 posts tagged sso.
The identity spine: Keycloak in front of an existing directory
Before the mesh can ask 'who are you?', something has to answer with authority. This part stands up Keycloak as the SSO front door and federates the existing directory read-only, adding MFA without migrating a single account.
Why we're tearing out a VPN that works
The old OpenVPN setup wasn't broken. It was a pile of per-user certificates and a manual onboarding ritual. Here's the case for replacing it with a self-hosted WireGuard mesh tied to the directory, and the one rule that keeps the swap from becoming an outage.