SAML 2.0 · OAuth 2.0 · OIDC · PKI
Identity is all we do.
We design, build and run workforce and customer IAM on Ping, ForgeRock and Okta, for organizations where getting access wrong is expensive.
What we do
Most identity programs start with one of these and grow into the others.
IAM platform programs
Selecting, designing and rolling out the platform your workforce or customer identity runs on, through to production.
Usually the multi-quarter program the other three hang off.
Identity automation
Provisioning, configuration and release pipelines for identity services, so a platform change goes through review like any other code.
Typically runs alongside a platform build rather than alone.
Platform migration
Moving applications off a legacy or end-of-life identity platform in waves, with old and new both serving users until the last cutover.
The co-existence period is the part that decides whether it works.
SSO and MFA
SAML 2.0, OAuth 2.0 and OpenID Connect integrations designed, debugged and rolled out, with MFA policy to match.
Often the first engagement, and the fastest to show a result.
Platforms we implement
- Ping Identity
- ForgeRock
- Okta
- Radiant Logic
- Keycloak
- Spring Security SAML
Proof of work
What we build, and how
We build tools for the identity work we repeat, and write up how they were made, including where AI helped and where it fell short. Two recent pieces:
live tool
saml-box.com
IdP on Keycloak · SP on Spring Security SAML · live
A public test Identity Provider and Service Provider for SAML integration, built as an experiment in AI-assisted development.
write-up
From Human-in-the-Loop to AI-in-the-Loop Debugging
September 2025
Using a language model to read logs, suggest fixes and generate code while debugging custom IAM endpoints — and where it falls short.
Inside the boundary
Workforce IAM
Employees, contractors and the systems they reach, on premises and in the cloud. The work is sign-on, access policy and the joiner, mover and leaver lifecycle, including the applications that were never built for any of it.
- Sign-on and MFA across employee apps
- Access policy by role and risk
- Legacy apps behind the same front door
- Access reviewed, not only granted
Across the boundary
Customer IAM
Customers sign up, sign in and manage their own accounts, at consumer traffic and under privacy law. The work is registration, login, recovery and fraud controls that people finish rather than abandon.
- Sign-up and sign-in customers finish
- Friction placed where the risk is
- Profile data held under privacy rules
- Sized for peak traffic, not the average
Recent writing
- From Human-in-the-Loop to AI-in-the-Loop Debugging: A Novel SchemeAI in Development and IAMAI is changing how software gets built. It is no longer experimental, with tools for code generation and debugging now part of…4 min
- SAML-BOX: A Test IDP and SP for Seamless SAML Integration, developed with AISAML-BOX (https://saml-box.com) is an online platform developed to simplify SAML testing and integration, offering both an Identity Provider (IDP) and a…6 min
- Identity Governance & Administration (IGA) Explained in Simple Words1. What is IGA?In general, Identity Governance and Administration (IGA) is a framework of policies to manage Access Permissions and Identity Lifecycle so as…11 min
The IAM Handbook
A 227-page reference on identity and access management, written by the team and free to read, chapter by chapter.
Download · PDF · 227 pages · 10 MB
Tell us what your identity program has to do next.
We will tell you what it takes, in writing, before anyone signs anything.