Identity and integration ops

The hands-on work of connecting a product to a customer: SSO with OIDC and SAML against Okta, Entra ID or Keycloak, provisioning, machine-to-machine API auth, file feeds over SFTP, and testing and debugging all of it with Postman, Newman, curl and a SAML tracer.

Every enterprise deal ends with the same three tickets: single sign-on against the customer's identity provider, a machine credential for the integration, and a nightly file or a webhook. This module teaches that work the way an implementation or solutions engineer does it: the browser mechanics and tokens underneath every login, OAuth 2.x and OpenID Connect the current way, SAML 2.0 and the Okta and Entra ID consoles, SCIM provisioning, API keys and signed webhooks, SFTP feeds, and the collections, tracers and logs that prove an integration works and show why it does not. Every practice path runs against a local Keycloak or SFTP server in Docker, with a no-Docker route named.

Part A. The web and tokens (4 lessons)

• Web sessions: cookies, CORS, CSRF and TLS · Practice

  Every single sign-on bug report arrives as a browser symptom: a cookie that was not sent, a redirect that lost the session, a request the browser refused to make, or a certificate the customer's laptop does not trust.

• Tokens and JWT validation · Practice

  A token is the thing a client shows to prove a login or a permission already happened.

• OAuth 2.x the current way · Practice

  OAuth 2.0 is how a client gets a token to call an API on someone's behalf, and most of what was written about it in its first decade is now wrong.

• OpenID Connect: ID tokens, discovery and logout · Practice

  OAuth 2.0 hands a client a token to call an API; it says nothing about who logged in.

Part B. Enterprise SSO and provisioning (3 lessons)

• SAML 2.0 single sign-on · Practice

  SAML 2.0 is older than OAuth, XML all the way down, and still how most enterprise customers' identity providers talk to the products they buy.

• Setting up SSO and provisioning with Okta and Entra ID · Practice

  The protocols are vendor-neutral; the job is not.

• Machine-to-machine API auth: keys, client credentials, mTLS and signed webhooks · Practice

  Most of the traffic in an enterprise integration has no user behind it: a nightly job pulling records, a service calling a partner's API, a vendor pushing events to a webhook.

Part C. Integration ops (3 lessons)

• File feeds over SFTP · Practice

  The file feed predates APIs and will outlive them: a nightly CSV dropped on an SFTP server is still how payroll, claims, orders and reference data move between a great many enterprises and the products they buy.

• API testing with Postman, Newman, Bruno and curl · Practice

  A saved collection of requests is how an integration engineer proves an API works, hands the proof to a customer, and keeps it working in CI.

• The SSO and integration troubleshooting runbook · Practice

  This is a runbook, not a theory lesson: what to do in the first twenty minutes of 'SSO is broken', 'the token is rejected', 'the file never arrived' or 'your webhook returns 400'.

Changes

• Version 1, 2026-10-14: new module: 10 lessons in parts A to C written by hand from the identity and integration ops spike (120 sources verified 2026-10-14; OIDC, OAuth, SAML, SFTP and API-testing practice run against Keycloak 26.4, node-oidc-provider 9 and atmoz/sftp); Okta and Entra steps reader-only