r/IdentityManagement
I built an OIDC Inspector that visualizes the auth flow — looking for feedback
Hey everyone,
I built OIDC Inspector, a tool for exploring an identity provider’s OpenID Connect configuration. Enter a domain or provider URL to inspect its endpoints, supported scopes, grant types, signing keys, and advertised PKCE support.
You can also visually see the interactions in the Authorization Code flow: the authorization request, redirect with a code, token exchange, UserInfo request, and API call. The sequence diagram uses the provider’s discovered endpoints to illustrate the flow.
The inspector is free to use, with no sign-up required: https://contextiq.trango-compute.com/dashboard/oidc-inspector
I’d appreciate feedback from anyone working with OAuth/OIDC, SSO, or identity integrations:
- Does the diagram make the flow easier to understand?
- What information would help you troubleshoot an integration?
- Are there providers or configurations it handles poorly?
I’m the maker, so candid criticism is welcome—especially anything confusing, missing, or technically inaccurate.
u/ContextIQ — 7 days ago
▲ 16 r/IdentityManagement
Best way to career change into IAM?
Hello, Ive been thinking about career changing into IAM analyst but i am unsure on how to break into my first position as I have zero background in IAM and IT field.
Background of me: I have BFA Degree in Graphic Design. I have some experience working as graphic designer (two internships + 6month full time) and currently i am working at a dental lab as a manager (its been about 6 months now). I am 26 years old male with citizenship living in Virginia if that matters.
I asked chatgpt and it said to build a home lab but i wasnt sure if building home lab is really enough to get my first position in this field, or should i tackle this differnetly.
u/Jumpy_Programmer_472 — 9 days ago
▲ 14 r/IdentityManagement
Waiting for status of a promotion, thinking of having a plan b if doesn't work out.
I do Identity Access Management on the privileged side of things in Active Directory.
I am currently fighting to get a promotion. Official title is Senior Analyst but have been doing duties as a Lead without lead pay for several months. I am the only person that knows 100% of our processes. I train others, create/modify procedures. I do reviews on everyone's work, do reviews for audit, basically everything but what a manager would do.
As someone who has been at the same place for 11 years, where are the most useful places to seek other IAM jobs? I have also been getting into Management, have an MBA. We've been on a hiring freeze for a couple of years.
u/VirusFeisty7157 — 9 days ago
Feels like on the job training is useless/doesn't transfer to "industry standards"
I've been working under the IAM umbrella in User Provisioning, dealing with Access Control, Account Provisioning/Deprovisioning and Joiner/Mover/Leaver (internally called something different) processes, contributing to Security Audits, and general IT Support dealing with account issues/permissions, O365 and MFA enrollments, and just about everything under the sun with IAM. However, I feel like none of my skills translate out of our niche implementation and I'm finding that in interviews with places running Sailpoint, Okta, Ping, or anything besides Saviynt (and even anything beyond some basic troubleshooting there) I feel completely out of my depth trying to explain that while I might not have experience with their specific toolkit I should be able to pick it up given X skill transferring to it.
I'm trying to work through a self-guided AZ-900 and AZ-104 module, but don't have the money to actually afford the certs at the moment, and I'm not sure what else is out there.
Anyone have any recommendations for good *free* resources to build or polish IAM skillsets with? Preferably that don't require running janky homelabs or monkey around with "free" (if you cancel in time) Azure subscriptions.
u/UserProv_Minotaur — 9 days ago
▲ 30 r/IdentityManagement
Identity Flows Diagram website
I've just launched identiflows.dev, a visual reference website for identity protocol flows.
It attempts to solve a problem I run into constantly. You know how OAuth 2.0 Authorization Code with PKCE works. You've explained it to other people. But when you need to double-check the exact sequence at 4 pm on a Friday, finding a clear diagram takes longer than it should.
This is a very early release, with just eight flows so far. I will add more diagrams and features soon, but in the meantime, I wanted to share it with you to get your feedback.
If you try it and find that something is missing or unclear, I'd genuinely like to hear about it. This is the stage of the project where feedback shapes what comes next.
Take a look: https://identiflows.dev
u/andychiare — 10 days ago
Who owns authorization after login? (Writeup on splitting ownership by layer, with a template table for deciding who owns what)
I've been in the iam space for a while, and in larger orgs i've seen the same gap quite often: who owns authorization (once someone is signed in).
Usually it's three teams and no owner. customer identity issues the tokens, the security identity team runs the corporate idp and sso, architecture has looked at it but has no mandate to change anything. Everyone agrees it's broken, and nobody is allowed to prioritize it, because it isn't theirs. Meanwhile a valid token from the idp means access to every platform endpoint, and the only isolation is a tenant id the gateway injects from a client cert.
When it does get assigned, it tends to land somewhere that only covers part of it. hand it to the identity team as an extension of the idp and it covers who can reach which app, but the rules about what someone can do to a specific account or payment stay in application code identity never sees. Leave it to each product team and you get a different permission check in every service, and nothing security can review in one place.
My colleague and i (i work at Cerbos) wrote up how to split it by layer instead of by team. it builds on the recent analyst work on iam operating models (for each capability, name who designs it, who runs it day to day and who supplies the data, and never leave one of those shared) and on the platform team model from team topologies, and applies both to authorization:
- Identity teams own the inputs, the claims and directory attributes every access decision depends on
- A platform team (or security architecture, if there isn't one) runs the decision point, policy repo, ci tests and decision logs
- Product teams own the resource policies for what they build
- Security / grc own the policy standard, review and recertification
there's also a template table (attached to this post) you can take into the meeting where the three teams argue about whose problem this is + a way to prove the split on one broken use case before rolling it out wider. For identity teams specifically, the ask in this model isn't to write application policy, it's to keep the data the decision uses accurate, which is the job you already have.
https://www.cerbos.dev/blog/who-owns-authorization-in-large-engineering-organization
Hopefully it will be helpful to some of you in this community. If you have any questions / comments - would be more than happy to hear them and do my best to help
u/Cerbosdev — 8 days ago
▲ 15 r/IdentityManagement
Orphan accounts across disconnected apps are becoming a real problem
We found a few active accounts in apps that arent tied to our IdP or HR offboarding flow. Some are old vendor tools, some are custom internal apps, and nobody seems sure who owns the data anymore.
Our IAM team is doing exports and spreadsheets right now, which is getting painful fast. I know we need an inventory of the disconnected apps and some way to keep checking for accounts with no active owner, but curious how other teams handle this in practice. Any hints?
u/Ill_Noticevernita805 — 11 days ago
Any suggestions for facilities team communication across different buildings? Everything usually gets left at the main desk
How is the person in building four supposed to see a note at the main desk? That's more or less our current setup and we have six buildings, maintenance, custodial and security on different shifts, plus calls and texts to personal numbers.
Radios handle urgent stuff. I'm after a place for notices and questions that works both ways, without a desk or work email. The questions coming back matter just as much as sending the update out.
u/metalrooke — 10 days ago
Quarterly access reviews are becoming expensive calendar theater
quarterly access reviews still make sense for privileged and sensitive access. but the giant spreadsheet campaign for every saas account is turning into a ritual where 40 mng click approve so we can all admire another audit screenshot.
for context we have access spread across saas, custom apps, service accounts and a pile of oauth grants nobody remembers approving. im looking at continuous discovery and smaller event driven reviews instead, with quarterly cert for the higher risk stuff.
has anyone actually moved away from the quarterly everything model without making grc miserable....,, (pls no vendor pitches)
u/Speific-Dresirvs1207 — 10 days ago
▲ 21 r/IdentityManagement
IAM ANALYST VS IAM ENGINEER
Im a recent grad and have quite been interested in the analyst side of things.
I want to start off as a junior sys admin, then move on to soc analyst, then iam analyst, then ultimately—GRC analyst.
But people tend to say that IAM analyst and IAM engineer are quite synonynous/ interchaengable with each other. Im not interested in the engineering side but is it true that this two roles are basically the same thing?
u/Main-Channel-9888 — 13 days ago
▲ 22 r/IdentityManagement
How do you use Claude to automate your job?
I need to spend a certain amount of AI tokens a month for my job so what ways do you use Claude to automate your job as IAM admins? We use OKTA as our IDP and I’m looking for ideas to brainstorm my own from
u/Myrtledude — 12 days ago
▲ 14 r/IdentityManagement
Identity governance keeps missing unmanaged applications
Our identity governance setup is only showing applications that are connected to the IdP, so we have a pretty clean dashboard that doesnt match reality.
People are using tools through direct logins, OAuth connections, browser sign ups, and a few apps paid for by departments. Those accounts dont show up in access reviews, and offboarding them is mostly someone remembering to check a spreadsheet.
I guess the main issue is that governance starts after an app is onboarded, but we have no good way to discover the apps before that point. We have IdP logs and finance data, but neither gives us the full picture. Has anyone found a sensible way to bring unmanaged applications into IAM without making every team fill out another inventory form?
u/Ill_Noticevernita805 — 13 days ago
SAML - emit non-public attributes
creating a SAML SSO app is, I'm sure, routine.
you can customise claims; by default, they can include given name, surname, email address, UPN, etc
so far so good
more complicated - pizza topping
An SSO app needs a user's favourite pizza topping.
I set 'extensionAttribute1' to the pizza topping, and emit 'extensionAttribute1' to the SSO app.
any user can view any other user's 'extensionAttribute1' value [unless you break Teams]. So, Alice seeing Bob's favourite pizza topping isn't a problem.
even more complicated - date of birth
now, the app also wants the user's date of birth.
I can't store the user's date of birth 'extensionAttribute2', because that information shouldn't be public. anyone in Microsoft Entra ID can read any other user's extensionAttribute2.
I can add extension attributes. But they have the same problem; any user can read any other user's extension attributes. It is, after all, a directory, not a database, and directories are optimised for looking up information.
There is the concept of custom security attributes, and they can't be read. But you can't emit them in SAML attributes.
Marius has proposed a solution;
Issuing Custom Security Attributes in Entra ID tokens – Good Workaround!
- use custom security attributes
- setup logic app as a custom security extension
- the logic app can read the custom security attributes and add an OIDC claim
Sounds good in theory. I can't get it to work. There's almost nothing to see to be able to debug it.
Can I use Microsoft Entra External ID for this? It would...
- store the date of birth
- federate with Microsoft Entra ID for authentication; just like social logins
The UML sequence diagram shows how this could work;
- User logs in to the SSO app.
- SSO app redirects user to Microsoft Entra External ID. The user isn't authenticated, so Microsoft Entra External ID redirects the user to Microsoft Entra.
- The user authenticates (if necessary) and it emits 'public' attributes, such as first name, last name, email.
- The response from Microsoft Entra is sent to Microsoft Entra External ID.
- Microsoft Entra External ID adds the date of birth (from the user profile)
- Microsoft Entra External ID sends the SAMLResponse to the SSO app
- User is authenticated.
context
- I can't write the date of birth directly into the SSO app; simply isn't possible
- I would use Microsoft Graph to write the date of birth to Microsoft Entra External ID
- (AD FS can work; but that means 'on prem' and 'AD DS'; want to avoid that)
I've dabbled with Azure AD B2C; it's pants. Everything is an XML document. Hoping Microsoft Entra External ID is easier.
Will this work? anyone done this?
Anyone got a better approach?
u/itproedu — 14 days ago
How IGA and AM link together?
How do IGA tools like sailpoint and AM tool like okta work together? What's the flow? I know there are all lot of resources but I can't get around the flow.
Thank you.
u/UmpireElectronic6680 — 13 days ago
Are quarterly access reviews pointless when managers approve everything in 10 minutes?
Pulled the numbers on our Q3 access reviews. One director approved 412 items in eleven minutes. Median time per item across all managers was four seconds.
I get why, nobody knows what a role like SAP_FI_ROLE_07 does, so they approve and move on. The reviews count as complete for audit, but people still have access from old jobs.
What would you change first if you were starting reviews from scratch?
u/Sejaa-Hvercraft-6672 — 13 days ago
Can one universal identity automatically present itself like different existing identities depending on where it is presented?
I'm exploring a general interoperability problem.
Imagine a person has 20 different memberships:
Brand A → membership ID 12345
Brand B → membership ID 67890
Brand C → phone number
Brand D → email
I'd like to know whether there is a way to create one universal digital credential containing all of these existing identities with an important constraint:
The participating brands do not change their existing software, databases, loyalty systems, checkout systems, or customer-identification processes.
When the customer presents the universal credential at Brand A, the existing infrastructure should somehow receive Brand A's existing identifier.
At Brand B, the same credential should somehow provide Brand B's identifier.
The universal credential itself could contain multiple identities, but the receiving system should ultimately get exactly what it already expects.
u/you_stupid_machine — 13 days ago
Anybody have experience bulk updating role names in Savyint?
Just wondering how you did it or any advice? So far thinking of using a job and SQL to do it but wondering if there’s a better way
u/N_inThe_A_D_inThe_P — 14 days ago
Building a authentication procedure from a desktop app via browser sign in.
Have what I think is a great configuration for achieving this but would like to hear thoughts on it.
Have a desktop app (currently only for WIN. Mac and Linux are coming) and the account are managed through a web project already and it contains entitlements per account. The desktop app runs checks to the web platform for auth, entitlements, and updates every time one of those is in question.
Thoughts?
If anyone has built this, what are things I should look out for? "gotchas"
u/BlueRainLabs — 13 days ago
10 yoe in ITSM with a laughable salary. Semi interested in IAM? Worth for me at this stage ?
Semi interested in having interacted with IAM folks a lot during my tenure as a major incident manager. So I'm not sure, have been doing some research around it. I'm open to picking up programming, but I dread deep low-level networking (TCP/IP, etc.).
Any advice to this old head
u/t7Saitama — 13 days ago