I specialize in federated identity and API security architectures with protocols like OpenID Connect and OAuth 2.0. I can help you troubleshoot basic configuration, wrangle complex integration issues, or design a complete API security architecture from scratch.
My expertise comes from implementing standards and specifications from scratch. As an open source developer at Anvil Research, I created some of the earliest available packages for OpenID Connect, OAuth 2.0, W3C Web Cryptography API, and JSON Object Signing and Encryption (JWT, JWS, JWE, JWK) used by countless developers, long before IDaaS products like AWS Cognito were widely adopted.
I've helped dozens of open source users and clients to:
- federate identity across organizations
- craft seamless shared sessions between applications
- choose the right auth flows for the use case
- provide API access to third party developers
- use tokens effectively to secure microservices
- choose access control models
- migrate to cloud identity providers
- integrate legacy systems like LDAP and SAML 2.0 with OIDC
- overcome thorny integration issues
- adapt client libraries to new frameworks and use cases
- use features like dynamic client registration
- make use of little known protocol features to solve subtle problems
- experiment with emerging specs like WebAuthn