Expertise
Identity & security
Enterprise single sign-on with OAuth, OIDC, SAML and SCIM, frictionless visitor identity, and air-gapped, secure-by-design delivery.
What problems look like here
- One sign-in across a group of products, at high availability.
- A legacy identity and authorisation system that has to keep working.
- Recognising a returning visitor without asking them for anything.
- Systems that must run in sites with no outside connection.
- Content that must stay encrypted on the device.
What I built
Case studies
-
Enterprise single sign-on for 100,000+ users
High-availability single sign-on across a group of products, on Keycloak with custom Java modules and authentication flows, scaled to 100,000+ users at 99.9% uptime.
-
In-flight entertainment platform for a national Gulf carrier
An Android passenger-entertainment app whose AES-256 encrypted media plays through an in-app local streaming server and is never written to storage decrypted, plus a separate news and digital-magazine system for the carrier's website.
More work
- Multi-tenant industrial IoT platform Broker-level MQTT, X.509 and JWT device authentication, OTA firmware and time-series telemetry. Stack: MQTT, X.509, JWT, OTA firmware
- Frictionless visitor identity Backend authentication for live-chat plugins used across many websites: it creates a customer from site traffic and recognises them on return with no input.
- Email sign-in with smart-contract wallets Account-abstraction sign-in that creates an ERC-4337 smart-contract wallet for each user; designed and built. Stack: ERC standards, Smart-contract wallets
Patterns I use
-
Extend a standards-based identity server (Keycloak) with custom modules and authentication flows.
-
Bridge a legacy authorisation system into Keycloak through LDAP rather than rebuild it.
-
Create the customer from site traffic and recognise them on return.
Used in Frictionless visitor identity.
-
Clearance-based sharing, so every view is filtered by who may see it.
-
Decrypt media inside the app and stream it through a local server, never to storage.
Used in In-flight entertainment platform for a national Gulf carrier.
-
Device identity with X.509 certificates and JWT.
Used in Multi-tenant industrial IoT platform.
Stack for this domain
Each links to its entry on the stack page.
Ask about this
What has he built in identity and security?
Answers come from the content on this site.
The chat needs JavaScript. Without it, ask through the contact page.