SCSam Critchleyinauthagonal.hashnode.dev·Jul 22 · 4 min readThe SCIM tax: provisioning is plumbing, not a premiumSCIM is the least glamorous protocol in identity. It is a REST API for user records: create, update, deactivate, standardized as RFC 7644 so that directories and apps only ever have to build it once. 00
SCSam Critchleyinauthagonal.hashnode.dev·Jul 14 · 4 min readYour password-reset form is a free email cannonThe password-reset form is probably the least interesting endpoint you own. It is also the only one an attacker can point at anyone. Ours had no per-email rate limit for a while, and the reason that m00
SCSam Critchleyinauthagonal.hashnode.dev·Jul 12 · 4 min readYour backup quietly resurrects the users you deletedEvery incremental backup makes the same quiet assumption: to back up what changed, find the rows that changed. On a key-value store like Azure Table Storage or DynamoDB, "what changed" means "rows who00
SCSam Critchleyinauthagonal.hashnode.dev·Jul 10 · 6 min readWe run a whole auth system on stores that only know get and putAn auth system looks like it wants a relational database. Users, roles, sessions, OAuth grants, refresh tokens, all cross-referenced. Ours does not use one. It runs on Azure Table Storage, a store tha00
SCSam Critchleyinauthagonal.hashnode.dev·Jul 7 · 6 min readOne hyphen, two tenants, one signing keyTwo of our tenants were the same tenant. They had different names, different signups, and different billing rows. They also shared a database and a token-signing key, and none of the three of us, the 00
