← Back
Home › Systems › Security and identity

identity-provider

identity provider / SSO with OAuth and OIDC

Okta, Keycloak

SystemTechniques · 14Primitives · 60 identity-provider Deterministic simulation testingdistributed · medium: Run the whole system in one thread under a seeded scheduler with simulated network, disk and clock, so every failure replays from its seed.›Primary-backup replicationdistributed · medium: One node orders all writes and ships them to standbys; the acknowledgement rule (none, one, all) sets what a crash loses, and an external arbiter decides who takes over.›Coverage-guided fuzzingsecurity · medium: Mutate inputs, run an instrumented target, and keep any input that reaches a new code edge; feedback turns blind guessing into incremental search.›Key rotationsecurity · medium: Rotating keys without downtime: key ids, overlap windows, re-wrapping, JWKS publication, revocationSamlsecurity · medium: SAML 2.0 assertions, XML signatures, SP/IdP flows and canonicalization pitfallsScim provisioningsecurity · medium: SCIM 2.0 user/group provisioning API: create, patch, deprovision, filtersTLS 1.3security · medium: The standard encrypted, authenticated transport; one round trip, only forward-secret AEAD suites, and little left to misconfigure.›Rsa cryptosystemsecurity · low: RSA key generation, OAEP encryption and PSS/PKCS#1 v1.5 signatures, key sizes and padding pitfallsCsprngsecurity · low: OS-backed cryptographically secure random numbers (getrandom), and when a fast PRNG is not enoughHdr histogramdata-structures · low: Log-linear bucketed histograms with bounded relative error for latency percentilesProcess supervisionhardware-os · low: A parent process starts services, reaps their exits and restarts them under a delay and burst-limit policy, then stops them with SIGTERM before SIGKILL.›Authorization models (RBAC, ABAC, R…security · low: How to decide who may do what to which object; roles for coarse rules, relationships for sharing, and checks on every object.›Constant time codesecurity · low: Writing secret-dependent code without branches or memory lookups on secrets; constant-time compare and selectDigital signatures (Ed25519)security · low: Small, fast, deterministic public-key signatures that prove who produced a message; the default for tokens, releases and protocols.›ECDSA signaturessecurity · low: The elliptic-curve signature standardised in FIPS 186-5 (P-256) and used by secp256k1 ledgers; 64-byte signatures, but a repeated or biased nonce leaks the private key.›JSON Web Token (JWT)security · low: A signed, URL-safe token carrying claims; the verifier's job is the checklist (pinned algorithm, key by kid, exp, aud, iss), not the format.›Ldap directorysecurity · low: LDAP directory model, bind, search filters and group membership queries for enterprise identityMutual TLSsecurity · low: TLS where the client also proves a certificate key, so every connection carries a verified, rotatable machine identity.›OAuth 2 and OpenID Connectsecurity · low: Delegated authorization (OAuth 2) and login on top of it (OIDC); use authorization code + PKCE for every user-facing client.›OWASP Top 10 riskssecurity · low: The web and API vulnerability classes that cause most real breaches, each with the one structural fix that removes it.›Passkeys (WebAuthn)security · low: Phishing-resistant login with a per-site key pair held by the device or password manager; the server stores only a public key.›Password hashing (Argon2id)security · low: Memory-hard, salted, deliberately slow hashing so stolen password databases can't be cracked cheaply on GPUs.›Sessions vs tokenssecurity · low: Opaque server-side sessions in cookies for browsers, short-lived signed tokens between services; revocation decides most cases.›+ 7 more techniques+ 44 more primitives

Similar systems

Share the most building blocks with this one.

auth-service 58 %agent-identity 41 %pki 40 %zero-trust 40 %tax-filing 38 %