Articles in this category. Show all categories
Administrators of a city government's personnel system must each touch only their part of it: everything, one agency, or one unit. I made the scope data — a grant is user, role and scope — checked by one rule, requested and approved by different people, and expiring on its own.
A laptop and a borrowed Colab GPU talked through a public MQTT broker that anyone could read. Giving that channel an identity took an afternoon on the broker and eight obstacles in the clients — mostly safeguards that were right for the old setup and wrong for the new one.
A failed login in a half-built service is either a misconfigured identity provider or wrong code. I rule out the first by rehearsing a full login with my own tool before writing any app, and found compliant providers still disagree on tokens and claims.
One rotation reaches seven services, and a value elsewhere can look exactly like one of their credentials, so search-and-replace could break an integration nobody watches. Working from an explicit list keeps the rotation inside its blast radius and away from the keys that only decrypt.
Get an email when a new article is published.