Single Sign-On Consolidation

The client had accumulated seven internal applications over about eight years, each with its own login and its own idea of what a role meant. Onboarding someone took a day of account creation across systems and offboarding was worse — an audit found accounts still active for people who had left more than a year earlier. Staff were reusing passwords across the internal tools, which everyone knew and nobody had time to fix. The goal was one sign-in, one place to grant and revoke access, and an actual answer to who can see what.

I led the technical side of a small team — myself, two engineers and a project manager — over about seven months. I owned the identity architecture and the migration sequence, and I was the person arguing with each application's owner about why their custom role model had to go. That negotiation was most of the work; the integration itself was fairly routine once each team agreed.

I stood up and configured the identity provider, designed the role and group model that all seven applications map onto, and wrote the integration for the three applications we owned directly. I built the provisioning sync that creates and deactivates accounts from the HR system, which is what actually solved the offboarding problem. I owned the migration plan and the fallback for each application. The two other engineers handled the four remaining integrations with my review; I wrote the pattern and then stayed out of their way.

I chose to self-host Keycloak rather than take a managed identity service, which was contested and I still think was right for this client — their data residency requirements made the managed options expensive and awkward, and their IT team was capable of running it. The trade-off is real operational burden, so I spent the last month on runbooks and upgrade rehearsals rather than features. I also refused to model the union of all seven applications' existing roles; instead we defined about a dozen organisation-wide roles and made each application map onto them, which forced three teams to simplify their permissions and generated the only serious friction in the project. Provisioning is one-directional from HR on purpose — I didn't want two systems both believing they own the truth about employment status.

Two of the seven applications are vendor products whose SSO support was, in one case, a paid add-on and in the other case documented but broken. That vendor took eleven weeks to fix it, which we absorbed by resequencing. We also couldn't take any application offline during business hours, and one is used by a team working across three time zones, so its cutover happened on a Sunday. Legacy password hashes couldn't be migrated, so every user had to reset, which needed a communications plan I hadn't budgeted for.

Onboarding went from about a day of account creation to a single HR record plus role assignment, roughly fifteen minutes. Offboarding became automatic — the next audit found no orphaned accounts, against dozens before. Password reset tickets, which had been the internal help desk's largest single category, fell to a small fraction of what they were. Less measurably, we can now answer an access question in one place, which came up in a client security review two months after handover and would previously have taken days.

The project manager kept seven application owners moving in roughly the same direction, which was harder than anything I did. The client's IT lead took over operations and rehearsed the first upgrade with me before we finished. One application owner pushed back hard on the shared role model for weeks and, having lost the argument, then wrote the best migration of the seven.