# identity provider Published articles for identity provider. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## SSO is broken? The answer is already in your session log DevFeed: [SSO is broken? The answer is already in your session log]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-11-09T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS]() Topics: [Single sign-on (SSO)](), [sessions](), [Logging](), [log management]() Tags: [configuration](), [customer](), [datadog](), [events](), [failed](), [identity-provider](), [it](), [sso](), [status](), [workos]() ### AI overview WorkOS session logs can pinpoint where an SSO failure occurs and who can fix it. In the dashboard, filter a connection's Sessions tab by email, status, origin or time, then inspect the IdP request, response and any error. Success shifts investigation to app handling or authorization; failed sessions may point to the IdP or to your attribute mapping. Required attributes that are missing can fail sign-in, while unmapped optional attributes return null and may leave a successful session with empty fields. Origin helps distinguish app-started, IdP-started and Admin Portal test flows; OIDC is SP-initiated only. For patterns, use SSO events with connection IDs and error details: stream them to Datadog or count failures by connection through the cursor-paginated Events API. When the IdP is responsible, share the session ID, timestamp, status and response with its administrator. ### Source excerpt Every WorkOS SSO attempt records its status, origin and the IdP's response. Read it in five minutes and know whether the fix is yours or the customer's. ## IdP-initiated SSO: How to turn a dashboard tile click into a normal sign-in DevFeed: [IdP-initiated SSO: How to turn a dashboard tile click into a normal sign-in]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-11-04T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS]() Topics: [Single sign-on (SSO)]() Tags: [app](), [application](), [authentication](), [authorization](), [callback](), [code](), [configure](), [dashboard](), [domain](), [email](), [flask](), [http](), [identity-provider](), [idp](), [localhost](), [login](), [sign-in](), [sso](), [workos]() ### AI overview For IdP-initiated SAML, WorkOS can redirect a dashboard tile click to your app's sign-in endpoint with a `connection_id`; your endpoint then calls Get Authorization URL and starts an ordinary SP-initiated flow. Configure the endpoint and allowed redirect URIs in the WorkOS Dashboard; production redirect URIs cannot use HTTP or localhost. The callback remains the usual authorization-code exchange, and the returned profile's organization ID should still be validated. Without a sign-in endpoint, the authorization code goes to the app's default redirect URI, and tenant routing must wait until the profile reveals its `connection_id`. RelayState can include a `client_id` to route to a particular application's endpoint. IdP-initiated login applies only to SAML; OIDC remains SP-initiated. ### Source excerpt Configure a sign-in endpoint and WorkOS turns an identity provider tile click into a normal SP-initiated sign-in, handing your app the connection_id it needs. ## Enterprise-managed auth for MCP: Claude can now issue the identity assertion DevFeed: [Enterprise-managed auth for MCP: Claude can now issue the identity assertion]() Original publisher: [Read original article]() Author: Cemal Kılıç; Wen Bo Xie Published: 2026-11-03T07:00:00Z Content type: release Language: en Sources: [Supabase]() Topics: [Authentication](), [identity and access management](), [Single sign-on (SSO)](), [Claude](), [cross-app-access]() Tags: [anthropic](), [assertions](), [auth](), [authentication](), [authorization](), [availability](), [beta](), [claude](), [claude-team](), [consent](), [enterprise](), [identity](), [identity-provider](), [managed](), [mcp](), [mcp-server](), [server](), [supabase]() ### AI overview Claude can issue the signed ID-JAG assertion for Supabase enterprise-managed auth when an identity provider lacks the MCP extension. After an organization admin approves Claude and registers its issuer URL, eligible members with matching Supabase SSO identities can connect using their existing roles without individual consent screens. Claude checks that the person belongs to the Claude organization and verifies the email on their Claude account; it does not check identity-provider sign-in status, MFA, or Supabase sign-in rules. Supabase validates Claude's signature, the member's matching SSO identity, and admin authorization before issuing a short-lived, member-bound token. Setup requires both organization admins and each member to have signed in to Supabase through SSO at least once. Key limits: identity-provider deactivation no longer removes access, so offboarding requires removing members from both organizations; issued tokens remain valid until expiry. Supabase accepts one issuer per SSO provider, and each issuer URL serves only one Supabase organization. Available to Supabase Team and Enterprise organizations with SSO; Claude auto-connect is in beta for Claude Team and an ### Source excerpt Claude can now issue the identity assertion for enterprise-managed auth on the Supabase MCP server when your identity provider can't. ## How authentik is handling post-quantum cryptography DevFeed: [How authentik is handling post-quantum cryptography]() Original publisher: [Read original article]() Author: Connor Peshek Published: 2026-11-03T00:00:00Z Content type: article Language: en Sources: [Authentik]() Topics: [Post-quantum cryptography](), [Cryptography](), [federal information processing standards](), [fips 140-3](), [openssl]() Tags: [1-3](), [access-management](), [access-tokens](), [admin](), [aes](), [algorithm](), [algorithms](), [cisa](), [cnsa-2-0](), [compliance](), [cryptography](), [identity](), [identity-provider](), [nist](), [post-quantum](), [post-quantum-cryptography](), [pqc](), [quantum](), [quantum-computer](), [requirements]() ### AI overview authentik says its TLS endpoints already use the X25519MLKEM768 hybrid key exchange, protecting traffic against harvest-now, decrypt-later attacks. Version 2026.11 adds ML-DSA certificates for controlled TLS connections, OIDC token signing and verification, and WebAuthn credentials; it also defaults new SAML and WS-Federation providers to AES-256-GCM. Existing SAML providers retain AES-128-CBC until changed. Limits include no public CA or browser support for ML-DSA certificates, no shipping authenticator support for ML-DSA passkeys, and the need for applications validating tokens to use a compatible JWT library. ML-DSA key generation is unavailable in FIPS mode pending a validated module. SAML signing awaits an XML Signature identifier, while ML-KEM token and assertion encryption awaits JOSE and XML Encryption specifications. ### Source excerpt What post-quantum cryptography is, why you shouldn't wait for a quantum computer to show up before caring, what the federal compliance requirements (NSM-10, CNSA 2.0, NIST IR 8547, CISA's PQC product list) mean for an identity provider, and what authentik supports now and what's coming next. ## Harness October 2026 Updates: 150+ Features Shipped. DevFeed: [Harness October 2026 Updates: 150+ Features Shipped.]() Original publisher: [Read original article]() Author: Chinmay Gaikwad Published: 2026-11-02T19:10:00Z Content type: release Language: en Sources: [Harness]() Topics: [CI/CD](), [Agent Harness](), [GitHub Copilot](), [Test automation](), [Deployment Strategies](), [software composition analysis](), [Single sign-on (SSO)]() Tags: [cosmos](), [fedramp](), [fedramp-20x](), [harness](), [identity-provider](), [mcp](), [october](), [october-2026](), [software-factory]() ### AI overview Harness's October 2026 updates span coding agents, delivery, security, and governance. Cosmos, the fifth Harness agent, can plan work from tickets or other triggers, write code and tests, open pull requests, and respond to review feedback; teams configure its experts, tools, environments, approvals, and budgets. Delivery updates include Worker Agents using GitHub Copilot or Harness-managed models, AI Verify reading four additional monitoring sources with adjustable sensitivity, and AWS AgentCore deployment options for gateways, S3 packages, and runtime identity. Code Coverage is generally available across eight language groups, with Python and Java test intelligence. Security updates add MCP schema and source-based access controls, API inventory and testing improvements, and Runtime Protection Agent PCI DSS and HIPAA assessments. Platform milestones include the first SOC 1 audit and FedRAMP 20x Class A; Class C and FedRAMP High remain in progress. For self-hosted Harness MCP, OAuth proxy mode authenticates through a customer identity provider and runs calls as the user, but requires contacting Harness support to enable. The excerpt also covers broader pipeline, registry, resilience ### Source excerpt Harness shipped 150 features in October 2026, including the Cosmos Software Factory Agent, MCP sign-in with your identity provider, and FedRAMP 20x Class A. | Blog ## OrionLink: Single Sign-On with Oblivious Identity Brokers DevFeed: [OrionLink: Single Sign-On with Oblivious Identity Brokers]() Original publisher: [Read original article]() Author: Yijia Fang, Bingyu Li, Luchao Jin, Jingqiang Lin, Mingxun Zhou, Zhijintong Zhang, Linghui Li, Qianhong Wu Published: 2026-11-02T05:00:00Z Content type: article Language: en Sources: [arXiv: Cryptography and Security]() Topics: [Single sign-on (SSO)](), [identity and access management](), [Cryptography]() Tags: [authentication](), [broker](), [credentials](), [cs-cr](), [encrypted](), [evaluation](), [exchange](), [federated](), [identity-provider](), [overhead](), [performance](), [pipeline](), [privacy](), [protocol](), [prototype](), [rp](), [security](), [single-sign-on](), [third-party](), [tracking](), [visibility]() ### AI overview OrionLink aims to reduce the privacy risks of third-party identity brokers in federated single sign-on while remaining compatible with brokered SSO architectures. It combines anonymous pseudonym derivation to provide unlinkable identifiers per relying party with anonymous key exchange to establish end-to-end encrypted channels that hide user data from brokers. The authors report a prototype and experimental evaluation showing substantial security and privacy improvements with acceptable performance overhead; the supplied abstract gives no specific measurements. ### Source excerpt arXiv:2610.41323v1 Announce Type: new Abstract: Single Sign-On (SSO) is a federated authentication mechanism that improves user experience by enabling access to multiple services, or Relying Parties (RPs), through a single authentication at an Identity Provider (IdP). To reduce integration complexity, many RPs rely on third-party Identity Brokers (Brokers) that aggregate numerous IdPs into a unified interface, thereby simplifying protocol management and interoperability. However, while brokers ease development, they introduce a fundamental security and privacy risk: sensitive authentication credentials and user behavioral data are exposed to the broker, creating a high-value single point of failure. Existing SSO solutions provide limited protection against these risks. With the goal of achieving broker obliviousness, we address these challenges at their root and present OrionLink, a comprehensive privacy-enhancing SSO pipeline that is compatible with existing brokered SSO architectures and systematically mitigates broker-induced risks without sacrificing usability. OrionLink incorporates two core components: (a) an anonymous pseudonym derivation scheme that generates unlinkable, per-RP identifiers to prevent cross-service user tracking; (b) an anonymous key exchange protocol that establishes end-to-end encrypted channels to protect user data from broker visibility. We further instantiate OrionLink with two new features, preserving broker functionality and deployability. We implemented a prototype of OrionLink within a brokered SSO environment, and experimental evaluation shows that the framework achieves substantial security and privacy improvements with acceptable performance overhead. ## From ORGADMIN to Control Plane: Organization Hub, Organization Users, and Premium Views in Practice DevFeed: [From ORGADMIN to Control Plane: Organization Hub, Organization Users, and Premium Views in Practice]() Original publisher: [Read original article]() Author: Vedprakash Published: 2026-10-26T19:01:02Z Content type: article Language: en Sources: [Snowflake Builders]() Topics: [control-plane](), [identity and access management](), [cloud cost management](), [observability]() Tags: [2026](), [account](), [adaptive](), [adaptive-compute](), [agent](), [cloud](), [compute](), [control](), [control-plane](), [cost](), [data-engineering](), [data-governance](), [docs](), [documentation](), [finops](), [history](), [hub](), [identity](), [identity-management](), [identity-provider](), [idp](), [organization](), [snowflake](), [users]() ### AI overview Snowflake's organization account centralizes multi-account visibility and identity management, but leaves warehouse grants and authentication in each account. GLOBALORGADMIN manages organization users and account lifecycle; importing a user group creates a same-named role in each account, while ACCOUNTADMIN still grants CREATE WAREHOUSE locally. Organization Hub and premium ORGANIZATION_USAGE views provide cross-account cost, security, query health, and warehouse-event visibility, with additional charges and up to two weeks to populate a full year of history. Viewer application roles can expose relevant Insights without granting GLOBALORGADMIN, and Hub also needs warehouse USAGE. Organization users can reduce duplicate identities, including SERVICE users for workloads, but authentication remains account-specific and dropping a global user affects every importing account. As of 11 October 2026, organization-wide QUERY_METERING_HISTORY was still marked "Coming soon," so Adaptive Warehouse per-query costs must still be collected from each account. The author has not deployed this design; the proposed rollout is based on documentation and demos. ### Source excerpt Running Snowflake in the Agent Era, Part 2 of 4. Part 1 made compute flexible inside one account. This part is about the one account that sees all the others.One organization account at the top acting as a control tower, with lines to several regular accounts across clouds, each with its own warehouses and users When someone asks "what did we spend last month" or "who has ACCOUNTADMIN where", the honest answer starts with "give me a while, I need to check each account". Part 1 of this series, "Stop Picking T-Shirt Sizes: What Running Adaptive Compute Taught Me", ended on three questions that Adaptive Compute does not answer. Who can create warehouses across accounts? Where is cost visible for the whole estate? How do identities stay consistent? Those questions are not abstract for me. Our estate is a multi-account setup spread across more than one cloud, and every account has its own SCIM or IdP integration. That is how users and roles reach each account from our identity provider (IdP), the system that manages our people's identities. SCIM (System for Cross-domain Identity Management) is the standard Snowflake supports for provisioning them from it. Snowflake now has one account whose entire job is the estate: the organization account. Several of its pieces became generally available during 2026. I want to be clear about where this post comes from. I have not run the organization account on our estate yet. Everything here comes from reading the documentation and release notes closely and watching demos, and it ends with what I would do. One status check first, because Part 1 promised it: as of 11 October 2026, the docs still mark the organization-wide QUERY_METERING_HISTORY view as "Coming soon". Three questions Part 1 left open A quick recap without repeating Part 1. Every Adaptive Warehouse in an account runs on a shared pool of compute that is dedicated to that account. Per-query cost for Adaptive Warehouses lives in QUERY_METERING_HISTORY in ACCOUNT_USAGE. So p ## Bring Your Own IdP to Harness MCP | OAuth Proxy Mode DevFeed: [Bring Your Own IdP to Harness MCP | OAuth Proxy Mode]() Original publisher: [Read original article]() Author: Piyush Patel Published: 2026-10-21T00:00:00Z Content type: article Language: en Sources: [Harness]() Topics: [OAuth](), [cross-app-access](), [pkce](), [Single sign-on (SSO)](), [Secrets Management](), [OAuth 2.0]() Tags: [aes](), [agent](), [agents](), [ai](), [ai-agent](), [ai-agents](), [ai-developer](), [blog](), [credentials](), [developers](), [enterprise](), [harness](), [identity-provider](), [idp](), [mcp](), [mcp-oauth](), [oauth](), [proxy](), [static](), [tokens]() ### AI overview OAuth proxy mode lets a self-hosted Harness MCP server accept a developer's company identity-provider token while calling Harness with that developer's linked HarnessID token. At sign-in, the broker redirects through the company IdP and HarnessID; the server stores HarnessID tokens encrypted, while the IDE receives the company token and a broker-issued refresh token. For each request, the server checks the company token's signature, issuer, audience, and expiry, then uses or refreshes the user's HarnessID token. A failed link or revoked refresh token returns 401 and requires sign-in again; the server does not fall back to shared credentials. The excerpt describes per-leg S256 PKCE, server-held client secrets, AES-256-GCM encrypted token storage, restricted callback URLs, and optional TLS-protected Redis storage across pods. Harness RBAC and audit logs apply to the individual user. Enabling the mode requires contacting Harness support. ### Source excerpt Learn how Harness MCP OAuth proxy mode enables enterprise developers to use their own identity provider without static tokens or shared credentials. | Blog ## Employee onboarding access checklist: From approved role to first sign-in DevFeed: [Employee onboarding access checklist: From approved role to first sign-in]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-10-20T19:39:49Z Content type: tutorial Language: en Sources: [WorkOS]() Topics: [Single sign-on (SSO)](), [rbac](), [Access Control](), [least privilege](), [account](), [Entra ID]() Tags: [account](), [activation](), [app-permissions](), [apps](), [authentication](), [authorization](), [employee](), [help-desk](), [identity-provider](), [onboarding](), [roles](), [setup](), [sign-in]() ### AI overview An onboarding checklist should track each required app, its approver and role, account setup, activation, authentication enrollment, and verified day-one access. Confirm the employee record and start time, resolve identity matches and licenses, and assign an owner to each dependency. Pre-provisioning allows account review before sign-in; just-in-time provisioning creates an account during the first successful SSO flow, so account creation and effective access must remain pending until verified. The excerpt distinguishes provisioning, activation, authentication, and authorization, and advises diagnosing failures by whether the account or assignment is missing, sign-in fails, or permissions block the task. It cites Entra lifecycle workflows and Temporary Access Pass as product-specific examples, and WorkOS identity matching as one implementation pattern. Keep secret credentials out of tickets, use the employee's own sign-in, record evidence and unresolved exceptions, and assign owners and deadlines. ### Source excerpt An employee onboarding access checklist for approved apps and roles, account setup, first sign-in, and evidence that day-one access works for each new hire. ## Contractor access management: A checklist for sponsors, scope, and end dates DevFeed: [Contractor access management: A checklist for sponsors, scope, and end dates]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-10-20T19:39:13Z Content type: tutorial Language: en Sources: [WorkOS]() Topics: [identity and access management](), [Access Control](), [Entra ID]() Tags: [acceptance](), [access-management](), [account](), [apps](), [authentication](), [automatic](), [backup](), [contractor](), [editor](), [engagement](), [exception](), [extension](), [external](), [fixed](), [guests](), [identity](), [identity-provider](), [it](), [scope](), [sponsors]() ### AI overview The checklist's central safeguard is to decide how contractor access will end when it is approved. Record a named internal sponsor, the contractor's identity, business reason, approved apps and permissions, and an end time. Verify who accepts each invitation, sign-in and device requirements, and the effective scope of each grant; treat policy exceptions and temporary additions as separately approved and time-limited. Use automatic expiration where available, or assign a named owner, backup, deadline, and verification step. Renew only after a sponsor confirms the person, work, and needed scope; silence does not approve an extension. When a sponsor leaves, transfer responsibility and review open engagements. At expiry, verify removal in every app, including any direct grants or app-specific session revocation. The excerpt distinguishes ending an Entra access-package assignment, which removes that package's access, from blocking or deleting the guest account under lifecycle settings; those settings apply to guests brought under entitlement management and do not automatically cover every external directory account. Keep an identity if it still supports another approved engagement. ### Source excerpt A contractor access management checklist for sponsors, approved scope, end dates, renewal decisions, and evidence that temporary access was removed from apps. ## What is Enterprise-Managed Authorization (EMA)? DevFeed: [What is Enterprise-Managed Authorization (EMA)?]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-10-20T00:00:00Z Content type: article Language: en Sources: [WorkOS]() Topics: [cross-app-access](), [Authorization](), [Access Control](), [OAuth 2.0](), [Single sign-on (SSO)](), [okta]() Tags: [2](), [2026](), [3](), [about](), [agent](), [agents](), [ai](), [ai-agents](), [app](), [apps](), [authorization](), [can](), [consent](), [enterprise](), [identity](), [identity-provider](), [managed](), [screen](), [what-is](), [work]() ### AI overview Enterprise-Managed Authorization (EMA) lets an identity provider (IdP) approve an AI agent's access to an app on an employee's behalf, replacing repeated per-user consent screens for configured connections. The agent signs in through SSO, requests a short-lived ID-JAG from the IdP, and presents it to the app's authorization server, which verifies it and issues a normal OAuth access token. IT can govern access through existing groups and roles; removing a user stops new ID-JAGs, while already-issued access tokens remain valid until expiry. EMA requires the IdP, agent, and app to support the flow and trust one another. The article says support is still narrow, the ID-JAG specification is a draft, and many internal APIs, databases, and CLIs remain outside its coverage. EMA governs app access and scopes, not approval of individual actions. ### Source excerpt How your identity provider can grant AI agents access to work apps, without a consent screen for every app and every agent. ## Citrix issues its weekly critical security patch for NetScaler ADC and NetScaler Gateway DevFeed: [Citrix issues its weekly critical security patch for NetScaler ADC and NetScaler Gateway]() Original publisher: [Read original article]() Author: Peter Sayer Published: 2026-10-09T14:24:22Z Content type: news Language: en Sources: [Network World]() Topics: [CVSS v4.0](), [saml](), [secure web gateway]() Tags: [citrix](), [critical](), [cvss](), [edition-us](), [gateway](), [identity-provider](), [language-en](), [netscaler](), [network-appliances](), [network-appliances-network-security-networking-networking-devices-security-vpn-vulnerabilities](), [network-security](), [networking](), [networking-devices](), [news-brief](), [patch](), [remote-code-execution](), [security](), [security-vulnerabilities](), [storytype-news](), [vpn](), [vulnerabilities](), [zero-day-vulnerabilities]() ### AI overview Citrix issued a critical security warning for NetScaler ADC and Gateway over a memory overflow vulnerability that can cause denial of service or remote code execution. It affects systems configured as SAML identity providers, and older versions configured as service providers. Citrix rated it 9.5 on CVSS v4.0 and recommended upgrading to patched versions; the company said it was not aware of unmitigated exploits. ### Source excerpt For the third week running, Citrix has issued a critical security warning to customers managing their own NetScaler ADC and Netscaler Gateway instances, this time warning of a memory overflow vulnerability enabling denial of service or remote code execution. This week's vulnerability affects ADC and Gateway when configured as a SAML (Security Assertion Markup Language) identity provider (IdP); older versions are also vulnerable when configured as a SAML service provider (SP), Citrix said in an advisory about the vulnerability, which it is tracking as CVE-2026-107406. Citrix rated the vulnerability critical, with a CVSS v4.0 score of 9.5. It said it was "not aware of any unmitigated exploits of this vulnerability." Nevertheless, it encouraged affected customers to upgrade to patched versions as soon as possible: 13.1-64.29 or later for the 13.1 series, and 14.1-73.46 or later for the 14.1 series of ADC and Gateway, and 13.1.37.283 or later for ADC 13.1-FIPS. Or 13.1-NDcPP. Citrix's recent run of bad news began on Sept. 27, a Sunday, when it advised users of NetScaler ADC and Gateway to take their systems offline and patch two critical unauthenticated remote code execution vulnerabilities immediately as they were both under active attack, prompting one security researcher to warn, "Monday will be too late." More flaws turned up last week including another memory overflow vulnerability (CVE-2026-88779), this one rated 8.7 on the CVSS 4.0 scale. Citrix said it was being actively exploited to cause denial of service. Citrix also released a new version of NetScaler ADC and Gateway, 14.1-60.58, that week, patching a critical memory overread vulnerability previously reported as CVE-2026-3055. Whether it's memory overflows or memory overreads, when it comes to fixing security vulnerabilities in its NetScaler products Citrix seems to have a memory problem. ## Introducing JWT authentication in ClickHouse Cloud DevFeed: [Introducing JWT authentication in ClickHouse Cloud]() Original publisher: [Read original article]() Author: ClickHouse team Published: 2026-10-08T13:55:14Z Content type: release Language: en Sources: [ClickHouse Blog]() Topics: [clickhouse](), [JSON Web Tokens](), [Authentication](), [OpenID connect (OIDC)](), [Access Control]() Tags: [authentication](), [clickhouse](), [identity-provider](), [jwt]() ### AI overview ClickHouse Cloud introduces JWT authentication using short-lived tokens from OpenID Connect providers instead of database passwords. The article explains provider configuration, client connections, token refresh, and ephemeral users whose permissions follow token claims. It also describes how quotas and policies persist across token expiration. Custom provider configuration requires the Enterprise plan and service version 26.4 or later. ### Source excerpt Connect to ClickHouse Cloud with short-lived tokens from your identity provider instead of database passwords. ## CISA flags new exploited NetScaler flaw as attackers crash appliances (CVE-2026-88779) DevFeed: [CISA flags new exploited NetScaler flaw as attackers crash appliances (CVE-2026-88779)]() Original publisher: [Read original article]() Author: Zeljka Zorz Published: 2026-10-05T14:53:48Z Content type: news Language: en Sources: [Help Net Security]() Topics: [known exploitable vulnerabilities](), [aws inspector](), [cybersecurity and infrastructure security agency]() Tags: [actively-exploited](), [authentication](), [bishop-fox](), [cisa](), [citrix](), [cve-2026-88779](), [denial-of-service](), [don-t-miss](), [exploited](), [hot-stuff](), [identity-provider](), [netscaler](), [news](), [security](), [watchtowr]() ### AI overview CISA added CVE-2026-88779, a memory overflow flaw affecting certain Citrix NetScaler ADC and Gateway versions, to its Known Exploited Vulnerabilities catalog. Targeted attacks can cause denial of service; exploitation is limited to vulnerable on-prem deployments configured with SAML alongside Gateway or AAA functionality. Citrix recommends upgrading to fixed versions and offers temporary signatures to block known malicious IP addresses while customers prepare. ### Source excerpt CISA has added another Citrix NetScaler vulnerability to its Known Exploited Vulnerabilities catalog on Sunday: CVE-2026-88779, a memory overflow bug that may cripple vulnerable NetScaler ADCs and Gateways. "Citrix has observed targeted attacks on unmitigated NetScaler deployments which can lead to Denial of Service. If the condition is triggered repeatedly, the service may remain unavailable," the vendor stated. "Our analysis indicates that this issue affects service availability, and we have not identified an impact on ... More -> The post CISA flags new exploited NetScaler flaw as attackers crash appliances (CVE-2026-88779) appeared first on Help Net Security. ## Introducing SCIM Provisioning in ClickHouse Cloud DevFeed: [Introducing SCIM Provisioning in ClickHouse Cloud]() Original publisher: [Read original article]() Author: Raymond Lee Published: 2026-09-30T17:23:47Z Content type: release Language: en Sources: [ClickHouse Blog]() Topics: [Security, Identity, & Compliance](), [Entra ID]() Tags: [api-keys](), [authentication](), [clickhouse](), [identity](), [identity-provider](), [idp](), [microsoft-entra-id](), [okta]() ### AI overview ClickHouse Cloud adds SCIM 2.0 provisioning, allowing identity providers to create and remove organization members and synchronize group membership with ClickHouse roles. The article describes setup through an existing SAML connection, scoped API credentials, and group-to-role mapping. ### Source excerpt ClickHouse Cloud now supports SCIM 2.0, so your identity provider can create, update, and deprovision organization members and sync group membership to ClickHouse roles automatically. ## Your agent, your network: How Meta's Muse agent works with Tailscale DevFeed: [Your agent, your network: How Meta's Muse agent works with Tailscale]() Original publisher: [Read original article]() Author: Andrew Cunningham Published: 2026-09-30T15:00:00Z Content type: article Language: en Sources: [Tailscale]() Topics: [Meta Tech Podcast](), [tailscale](), [zero trust network access](), [Web](), [Homelab]() Tags: [agent](), [ai](), [ai-agent](), [attacks](), [connectors](), [credentials](), [data-exfiltration](), [devices](), [external-services](), [gmail](), [google](), [identity](), [identity-provider](), [linux](), [microsoft](), [mobile](), [network](), [node](), [outlook](), [tailscale]() ### AI overview Meta's Muse personal AI agent runs in a Linux virtual machine with safeguards intended to limit prompt injection and data exfiltration. It connects to Tailscale as a separate node, letting it access machines in a user's tailnet; the article describes how that integration works across mobile, desktop, and web clients. ### Source excerpt Meta's Muse connects to Tailscale. You decide what it can reach. ## authentik is now OpenID Certified DevFeed: [authentik is now OpenID Certified]() Original publisher: [Read original article]() Author: Connor Peshek Published: 2026-09-30T00:00:00Z Content type: news Language: en Sources: [Authentik]() Topics: [OpenID connect (OIDC)](), [Open Source]() Tags: [certification](), [identity-provider](), [openid-connect]() ### AI overview authentik version 2026.8 is OpenID Certified for five OpenID Provider profiles and three logout profiles. The article explains how the OpenID Foundation's conformance suite checks both valid requests and failure behavior, and describes authentik's path toward certification. ### Source excerpt authentik is now OpenID Certified. Here's what the conformance tests found, and why the certificate matters less than the tests behind it. ## SSO vs OAuth vs OIDC vs SAML DevFeed: [SSO vs OAuth vs OIDC vs SAML]() Original publisher: [Read original article]() Author: Nikki Siapno Published: 2026-09-29T12:44:20Z Content type: tutorial Language: en Sources: [Level Up Coding System Design Newsletter]() Topics: [Single sign-on (SSO)](), [OAuth](), [OpenID connect (OIDC)](), [saml](), [OAuth 2.0](), [Authentication](), [Access Control]() Tags: [authentication](), [authentication-vs-authorization](), [authorization](), [credentials](), [identity-provider](), [oauth](), [oidc](), [saml](), [sso]() ### AI overview The article distinguishes SSO as a sign-in experience from OAuth 2.0, OIDC, and SAML as mechanisms that address access and identity. It explains authentication versus authorization and describes how applications can trust a shared identity provider for federated sign-in. ### Source excerpt Do you know the differences? Here's a clear breakdown to make them click. ## Require proof of presence for high-impact actions DevFeed: [Require proof of presence for high-impact actions]() Original publisher: [Read original article]() Author: Allison Published: 2026-09-24T20:28:33Z Content type: release Language: en Sources: [GitHub Changelog]() Topics: [MFA](), [Credential theft]() Tags: [authentication](), [compliance](), [entra-id](), [github-enterprise-cloud](), [identity-provider](), [mfa](), [policies](), [preview](), [security](), [sudo]() ### AI overview GitHub Enterprise Cloud public preview lets eligible managed user enterprises require fresh authentication before high-impact actions. It is limited to enterprises on github.com or GHEC-DR that use Microsoft Entra ID for SSO through SAML or OIDC. GitHub redirects the member to Entra ID, where enterprise policy can require re-authentication (which may be satisfied by a password) or re-authentication plus MFA; the action proceeds only after the member returns with proof of meeting the policy. A successful challenge permits further high-impact actions in that browser session for two hours. The feature is intended to guard against compromised sessions or tokens and support fresh-authentication compliance needs. Proof of presence before pull request merges is not yet available. ### Source excerpt You can now require an interactive re-authentication or a multi-factor challenge before members take high-impact actions on GitHub Enterprise Cloud accounts. Proof of presence is an expansion of GitHub's sudo... ## Debugging with SCIM Logs DevFeed: [Debugging with SCIM Logs]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-18T18:09:09Z Content type: release Language: en Sources: [WorkOS]() Topics: [Provisioning](), [debugging](), [protocols]() Tags: [client](), [customers](), [debugging](), [directory](), [enterprise](), [entra-id](), [identity-provider](), [logs](), [okta](), [payload](), [protocol](), [provisioning](), [request](), [server-logs](), [support]() ### AI overview WorkOS introduces a Logs tab for SCIM directories. Customers can review recent provisioning requests, exact request and response payloads, statuses, and failure messages explaining what went wrong and how to fix it. ### Source excerpt SCIM directories now have a Logs tab with every provisioning request your IdP sent, the exact payloads, and a debug message explaining what failed and why. ## How Does CockroachDB Automate SQL User Lifecycle Management? DevFeed: [How Does CockroachDB Automate SQL User Lifecycle Management?]() Original publisher: [Read original article]() Author: Pritesh Lahoti,Biplav Saraf,Sourav Sarangi Published: 2026-08-28T00:00:00Z Content type: article Language: en Sources: [Cockroach Labs]() Topics: [CockroachDB](), [OpenID connect (OIDC)](), [active directory](), [identity and access management](), [Logging](), [Single sign-on (SSO)](), [Secure token management](), [Entra ID](), [okta](), [Cockroach Labs]() Tags: [access-management](), [active-directory](), [automate](), [cockroachdb](), [directory](), [enterprises](), [entra-id](), [iam](), [identity](), [identity-and-access-management](), [identity-provider](), [idp](), [lifecycle](), [management](), [microsoft](), [microsoft-entra-id](), [okta](), [ory](), [sql](), [user]() ### AI overview CockroachDB automates SQL user lifecycle management for externally authenticated users: LDAP, JWT, or OIDC can create a SQL user on first successful login and stamp its immutable PROVISIONSRC with the authentication method and identity provider. When authorization is enabled, each login replaces the user's synchronized role memberships with current IdP groups; matching database roles must already exist, and changes take effect at the next login. Operators can filter users by source and estimated last login to review accounts, then use DROP PROVISIONED ROLES for scoped bulk cleanup. It requires CREATEROLE, protects root and admin, skips users with dependencies with a NOTICE, and records drop audit events. Login time is best-effort, not a complete authentication log; users with no recorded login are not included in last-login-before queries and need separate review. The article says PostgreSQL drivers can carry LDAP passwords or JWTs through the standard password field; OIDC is for DB Console browser login, with JWTs available for subsequent SQL connections. ### Source excerpt Fortune 1000 enterprises widely rely on major Identity Provider (IdP) and Identity and Access Management (IAM) platforms like Okta, Microsoft Entra ID, Microsoft Active Directory, and Ory. ## How a team of entity maintainers monitors, connects and scores entities in Elastic Security DevFeed: [How a team of entity maintainers monitors, connects and scores entities in Elastic Security]() Original publisher: [Read original article]() Author: Uri Weisman,Mike Paquette Published: 2026-08-24T00:00:00Z Content type: article Language: en Sources: [Elastic Security Labs]() Topics: [Maintainers](), [Security](), [observability](), [Security Information and Event Management (SIEM)](), [Risk](), [incident]() Tags: [cloud](), [identity-provider](), [incident](), [logs](), [maintainers](), [risk](), [security](), [security-operations](), [service](), [telemetry](), [user]() ### AI overview This article explains how Elastic Security's Entity Store uses continuously running maintainers to build, enrich, connect, and score user, host, and service records. It describes entity graphs, identity resolution, relationship tracking, telemetry enrichment, and risk scoring for threat hunting and incident investigations. ### Source excerpt Inside Elastic Security, background jobs called maintainers each own one piece of every user, host and service record, from building entities out of raw logs to resolving identities and scoring risk. ## One sign-in for your whole organization: Avrea SAML SSO DevFeed: [One sign-in for your whole organization: Avrea SAML SSO]() Original publisher: [Read original article]() Author: Hannu Valtonen Published: 2026-08-18T00:00:00Z Content type: release Language: en Sources: [Avrea Blog]() Topics: [Single sign-on (SSO)](), [saml]() Tags: [ci-cd](), [dns](), [domains](), [enterprise](), [entra-id](), [identity-provider](), [just](), [okta](), [provisioning](), [saml](), [sso]() ### AI overview Avrea Enterprise adds organization-level SAML SSO for CI/CD access, connecting to any SAML 2.0 identity provider that exports metadata and signs assertions, including Okta, Microsoft Entra ID, Google Workspace, Keycloak, and OneLogin. Members authenticate under their IdP's policies; Avrea stores no passwords. Optional just-in-time provisioning creates memberships with a chosen default role, and verified email domains can be required to use SSO, blocking direct GitHub or Google sign-in for those members. Setup uses IdP metadata, attribute mapping, DNS TXT domain verification, and a test sign-in before enforcement. SAML establishes identity while linked GitHub permissions continue to control repository access. The article says SSO is included with Avrea Enterprise. ### Source excerpt SAML SSO is available with Avrea Enterprise. Put CI/CD access behind Okta, Entra ID, or any SAML 2.0 identity provider, with just-in-time provisioning, verified domains, and enforced sign-in. ## Consolidating IAM without disruption DevFeed: [Consolidating IAM without disruption]() Original publisher: [Read original article]() Author: Fletcher Heisler Published: 2026-07-28T00:00:00Z Content type: article Language: en Sources: [Authentik]() Topics: [identity and access management](), [Security](), [Keycloak](), [okta](), [legacy systems](), [on-prem](), [Open Source](), [Software as a service](), [Cloud]() Tags: [engineering](), [fragmentation](), [iam](), [identity](), [identity-provider](), [keycloak](), [legacy](), [okta](), [on-prem](), [open-source](), [saas](), [security](), [technical-debt]() ### AI overview A practical playbook for consolidating fragmented identity and access management environments. It discusses deciding which systems to consolidate, retire, or leave in place, while modernizing legacy identity infrastructure without a disruptive cutover. ### Source excerpt Breaking up with your identity provider(s) doesn't have to be painful. [Next page]()