Identity

Human authentication has a person in the loop: a password, a passkey, a push notification, an MFA prompt. Machine-to-machine (M2M) authentication does not. A batch job at 03:00, a payments service calling a ledger, a Kubernetes pod pulling a config — none of them can answer a challenge, and none of them should hold a password a human typed. The whole field is one question asked over and over: how does a workload prove which workload it is to another party, without a long-lived secret that can leak? This post is a map of the answers — the standards, what each one actually protects against, and how the identity providers and cloud hyperscalers implement them. Simple terms, diagrams, and code. ...

Apache Syncope is one of those projects everyone in identity has heard of and few have read the source of. Over a few months I read enough of it to land five fixes upstream, and this is the write-up I wish I’d had going in. Two parts: first the map — features, stack, code layout — then a plain overview of the patches. No heroics; an approbation post. Part 1 — The product What it does Syncope is an identity lifecycle engine. It owns the authoritative record of users, groups, and arbitrary “any-objects”, and propagates changes out to the systems that actually enforce access — an LDAP directory, a database, Azure AD, a SCIM endpoint. It is not an OIDC provider bolted onto a user table; it is the thing that decides a user exists, computes what that means on each connected resource, and pushes it there. ...

Keycloak is the default answer when you need OIDC and SAML, a user federation layer, and an admin surface that other teams can operate — without writing an authorization server yourself. It joined the CNCF as an incubating project in 2023, and the 25.0 release (June 2024) is the cleanest it has ever been to run on Kubernetes: the WildFly distribution is gone, health and metrics moved off the public port, and hostname configuration was rebuilt. ...

Most teams that need an identity operation Keycloak doesn’t ship — “resolve this user’s effective entitlements in one call”, “let a user accept updated terms”, “expose a tenant-scoped lookup” — build a separate microservice. That service then has to validate Keycloak’s tokens, hold a service-account credential to call the Admin REST API, reconstruct realm and group logic over HTTP, and get deployed, scaled, and monitored as its own thing. It’s a lot of moving parts to add one endpoint. ...