# Single sign-on (SSO) Single sign-on (SSO) is an authentication method that lets users access multiple applications and websites with one set of login credentials, using identity providers and authentication standards. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## I Added Break-Glass Accounts Before My Home Lab Locked Me Out DevFeed: [I Added Break-Glass Accounts Before My Home Lab Locked Me Out]() Original publisher: [Read original article]() Author: Brandon Lee Published: 2026-09-14T12:16:15Z Content type: article Language: en Sources: [Virtualization Howto]() Topics: [Homelab](), [Authentication](), [Single sign-on (SSO)](), [Docker](), [Database](), [networking](), [Server](), [Amazon Route 53]() Tags: [authentication](), [container](), [database](), [dns](), [docker](), [home-lab](), [home-server](), [infrastructure](), [networking](), [server](), [sso]() ### AI overview The article explains why a home lab that centralizes authentication through single sign-on can become inaccessible during an outage. It introduces "break glass" accounts as a recovery measure and emphasizes treating the authentication service as infrastructure with dependencies such as its application, database, certificates, networking, reverse proxy, and DNS. ### Source excerpt One of the coolest things that you can do is centralize your authentication in the home lab. So, instead of having all kinds of separate usernames and passwords that are... The post I Added Break-Glass Accounts Before My Home Lab Locked Me Out appeared first on Virtualization Howto. ## How to answer the identity questions on an enterprise security questionnaire DevFeed: [How to answer the identity questions on an enterprise security questionnaire]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-14T00:00:00Z Content type: article Language: en Sources: [WorkOS Blog]() Topics: [Security](), [Single sign-on (SSO)](), [Provisioning](), [OpenID connect (OIDC)](), [App]() Tags: [configuration](), [enterprise](), [how-to](), [identity](), [integration](), [oidc](), [okta](), [provisioning](), [saml](), [security](), [sign-in](), [sso]() ### AI overview A practical guide to answering identity-related questions in enterprise security questionnaires. It explains what reviewers are really assessing behind SAML single sign-on and SCIM provisioning questions, including implementation details such as per-organization configuration, certificate rotation, and reliable deprovisioning. ### Source excerpt Every line has a literal answer and a real question behind it. Here is what the buyer is actually checking, which answers you can buy, and the three you cannot fake. ## AuthKit vs Better Auth for B2B SaaS DevFeed: [AuthKit vs Better Auth for B2B SaaS]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-14T00:00:00Z Content type: comparison Language: en Sources: [WorkOS Blog]() Topics: [Software as a service](), [Single sign-on (SSO)](), [Security](), [log management](), [threat detection](), [Frameworks](), [MFA](), [Passkeys]() Tags: [auth](), [comparison](), [enterprise](), [logs](), [mfa](), [saas](), [security](), [threat-detection](), [vercel]() ### AI overview This comparison examines AuthKit and Better Auth as platforms for B2B SaaS products selling to enterprise IT buyers. It argues that both now provide core capabilities such as SSO, SCIM, and audit logs, so the meaningful differences are provider coverage, where user lifecycle management begins, and contractual responsibility. The article also describes Better Auth's hosted infrastructure, dashboard, SIEM drain, self-service provisioning, and threat detection features, while noting its convergence with AuthKit on enterprise requirements. ### Source excerpt Both ship SSO, SCIM and audit logs now. The comparison that decides enterprise deals has moved to the long tail: provider coverage, where user lifecycle actually starts, and who is contractually on the hook. ## How to Implement OIDC Back-Channel Logout DevFeed: [How to Implement OIDC Back-Channel Logout]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-08T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [OpenID connect (OIDC)](), [Single sign-on (SSO)](), [JSON Web Tokens](), [App](), [Server]() Tags: [how-to](), [implement](), [jwt](), [oidc](), [server](), [sso](), [token](), [tokens]() ### AI overview This tutorial explains OIDC back-channel logout, including provider discovery, endpoint registration, form-encoded logout requests, and logout-token validation. It also describes how session-specific and user-wide logout work and notes limitations acknowledged by the specification. ### Source excerpt It is the one standard that can end a session your app already issued, it has been final since 2022, and almost nobody implements it. Here is the whole mechanism, the validation your endpoint owes, and the two limitations the spec admits to itself. ## How to add SSO to your B2B SaaS app with WorkOS AuthKit DevFeed: [How to add SSO to your B2B SaaS app with WorkOS AuthKit]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-07T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [Single sign-on (SSO)](), [Software as a service](), [Authentication](), [SDKs]() Tags: [asp-net](), [asp-net-core](), [authentication](), [b2b](), [claude](), [cli](), [codex](), [configuration](), [cursor](), [how-to](), [saas](), [sdk](), [sso]() ### AI overview A tutorial on adding SSO to a B2B SaaS application with WorkOS AuthKit. It explains that AuthKit handles SSO-specific SAML operations, while developers must design the organization model, configure who manages connections, account for existing users, and test failure cases. ### Source excerpt Enabling SSO is a dashboard toggle. The real work is the organization model, self-service configuration, and the traps that surface after your first enterprise customer. ## Auth0 vs Frontegg vs WorkOS: Who's actually enterprise ready in 2026? DevFeed: [Auth0 vs Frontegg vs WorkOS: Who's actually enterprise ready in 2026?]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-07T00:00:00Z Content type: comparison Language: en Sources: [WorkOS Blog]() Topics: [Auth0](), [Single sign-on (SSO)](), [Authentication](), [Authorization]() Tags: [auth0](), [comparison](), [enterprise](), [feature](), [pricing](), [sso]() ### AI overview The article compares Auth0, Frontegg, and WorkOS on enterprise readiness by checking vendors' pricing pages for self-service SSO and SCIM, enterprise features, and costs at scale. It highlights conflicting information on Auth0's pricing page about Self-Service SSO and describes a footnote requiring an upgrade to B2B to continue using certain features. ### Source excerpt We checked the roundups' claims against all three vendors' own pricing pages, using one test: can your customer's IT admin configure SSO and SCIM themselves, on the plan you already pay for? ## Three identity vendors shipped the same agent access pattern in eight days DevFeed: [Three identity vendors shipped the same agent access pattern in eight days]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-04T16:24:43Z Content type: article Language: en Sources: [WorkOS Blog]() Topics: [Auth0](), [Authorization](), [MCP](), [OpenID connect (OIDC)](), [Single sign-on (SSO)](), [Model Context Protocol]() Tags: [anthropic-claude](), [api](), [auth0](), [authorization](), [cross-app-access](), [identity](), [mcp](), [oidc](), [okta](), [sso]() ### AI overview Okta, Auth0, and Descope shipped implementations of the Cross App Access agent-access pattern between August 24 and September 1. The pattern uses a Client ID Metadata Document to identify calling software and an ID-JAG token exchange to let an identity provider control application access. ### Source excerpt Okta, Auth0, and Descope all shipped Cross App Access between August 24 and September 1. The two-layer pattern underneath it outlasts whichever vendor wins. ## Auth0 launches Early Access for enterprise-managed authorization in client apps DevFeed: [Auth0 launches Early Access for enterprise-managed authorization in client apps]() Original publisher: [Read original article]() Author: Mira Sharma Published: 2026-09-01T00:00:00Z Content type: release Language: en Sources: [Auth0 Blog]() Topics: [Auth0](), [Authorization](), [AI Agent](), [Model Context Protocol](), [OAuth](), [Single sign-on (SSO)]() Tags: [ai](), [ai-agent](), [authentication](), [enterprise](), [identity](), [mcp](), [model-context-protocol](), [oauth](), [release](), [saas](), [security](), [sso]() ### AI overview Auth0 announces Early Access for Client App capabilities that implement enterprise-managed authorization through Cross App Access and the ID-JAG draft specification. The feature lets an application or AI agent request access to external APIs or MCP servers using an employee's existing corporate SSO trust, reducing custom token-exchange work and supporting centralized governance. ### Source excerpt Implement Enterprise-Managed Authorization in Auth0 using Cross App Access (XAA) and ID-JAG. Build enterprise-ready AI agents without friction. ## Your app is the other half of agent SSO DevFeed: [Your app is the other half of agent SSO]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-31T20:22:53Z Content type: opinion Language: en Sources: [WorkOS Blog]() Topics: [Single sign-on (SSO)](), [Authorization](), [JSON Web Tokens](), [OAuth 2.0](), [computer-use]() Tags: [ai-agents](), [app](), [authorization](), [jwt](), [oauth-2-0](), [security](), [sso]() ### AI overview This commentary explains that Okta's Agent SSO and the Cross App Access standard broker connections between AI agents and enterprise applications, but the connected application remains responsible for validating the grant and issuing its own access token. It describes the resource-side roles and the underlying OAuth and JWT-based standards. ### Source excerpt Okta's Agent SSO went GA on the Cross App Access standard. The IdP brokers the connection, but your app still has to validate the grant and issue the token. ## How to migrate from a custom auth system to a third-party provider DevFeed: [How to migrate from a custom auth system to a third-party provider]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-26T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [migration](), [passwords](), [Single sign-on (SSO)](), [saml]() Tags: [auth](), [how-to](), [migration](), [password](), [rollback](), [saml](), [sso](), [third-party]() ### AI overview A guide to moving from a custom authentication system to a third-party provider. It explains how password-hash portability, SSO callback control, and an inventory of existing authentication components determine the migration strategy and cutover plan. ### Source excerpt What is actually portable, how to import password hashes without forcing a reset, and how to cut over with a rollback you can trust. ## Fewer lockouts, less manual work: What's new for 1Password EPM admins DevFeed: [Fewer lockouts, less manual work: What's new for 1Password EPM admins]() Original publisher: [Read original article]() Author: info@1password.com (Jairo Camacho) Published: 2026-08-26T00:00:00Z Content type: release Language: en Sources: [Blog on 1Password Blog]() Topics: [Provisioning](), [Multi-tenancy](), [Entra ID](), [releases](), [Single sign-on (SSO)]() Tags: [documentation](), [entra-id](), [identity](), [integration](), [multi-tenancy](), [news](), [outage](), [releases](), [scale](), [security]() ### AI overview 1Password announces releases for EPM admins focused on reducing lockouts and automating provisioning at scale. The updates include Entra ID secret-expiration tracking with reminders and guided rotation, integration between Multi-Tenancy and Automated Provisioning, and Vault Migrations for populating shared vaults in linked accounts. ### Source excerpt As a company grows, more employees join, but the size of the IT team overseeing critical systems often doesn't grow at the same pace. Admins have to be intentional about prioritizing their efforts to meet the needs of a growing organization. That's why we're excited to announce several releases aimed at helping admins optimize their organization's use of 1Password in two important areas: reducing lockouts and automating provisioning at scale. Preventing avoidable lockouts Entra ID Secret Expiration Most 1Password Business accounts sign in via SSO through an identity provider like Microsoft Entra ID. Admins rely on a secret provisioned by Entra to establish connectivity with 1Password. However, it comes with an expiration date. Once it expires, the connection breaks, preventing anyone from signing in. This was one of the most common and disruptive patterns we'd observe with customers. Entra ID Secret Expiration now tracks it for you. Simply record the expiration date, and 1Password will send escalating reminders across in-app banners, emails, and login prompts at a fixed cadence (e.g., 90/60/30 days). Once it's time to rotate the secret, follow the guided flow in the Admin Console, confirm it's working as intended, and the countdown resets automatically. A predictable secret expiration date should never become an outage, and now it doesn't have to. Standing up new parts of the business quickly Multi-Tenancy and Automated Provisioning integration Earlier this year we released Multi-Tenancy and Automated Provisioning, hosted by 1Password, two critical features for admins to manage provisioning, deprovisioning, and parent/child accounts at scale. Now admins can use these features in tandem, so enterprises with multi-tenant setups can take advantage of Automated Provisioning. To get started, check out our detailed documentation for setting up the Multi-Tenancy and Automated Provisioning integration To get started, check out our detailed documentation for setting up the M ## How Auth0 Plans Support Apps From Vibe Coding to Enterprise SSO DevFeed: [How Auth0 Plans Support Apps From Vibe Coding to Enterprise SSO]() Original publisher: [Read original article]() Author: Ruhma Khawaja Published: 2026-08-25T00:00:00Z Content type: article Language: en Sources: [Auth0 Blog]() Topics: [Auth0](), [Authentication](), [Single sign-on (SSO)](), [app builder](), [Vibe coding](), [soc 2 compliance](), [Multitenancy]() Tags: [app-builder](), [auth0](), [authentication](), [compliance](), [soc-2-compliance](), [sso](), [vibe-coding]() ### AI overview The article describes how Auth0 positions its pricing and authentication plans for different stages of app development, from AI-assisted solo builders and startups to scaling companies and enterprises. It highlights free authentication, SSO, SCIM, organizations, and security compliance features. ### Source excerpt Learn how Auth0 pricing plans scale with your app -- from free auth for AI vibe coders to B2B Enterprise SSO for scaling startups and enterprise platforms. ## Add Cross App Access to Your OIDC Resource Application DevFeed: [Add Cross App Access to Your OIDC Resource Application]() Original publisher: [Read original article]() Author: Sohail Pathan Published: 2026-08-24T05:00:00Z Content type: tutorial Language: en Sources: [Okta Developer]() Topics: [OpenID connect (OIDC)](), [API](), [Authorization](), [JSON Web Tokens](), [Single sign-on (SSO)](), [OAuth 2.0]() Tags: [api](), [authorization](), [cross-app-access](), [jwt](), [oauth-2-0](), [oidc](), [okta](), [scopes](), [sso](), [token](), [xaa]() ### AI overview This guide explains how OIDC-federated applications can support Cross App Access (XAA) for API access on behalf of users. It covers validating and redeeming the ID-JAG, resolving users from claims, issuing access tokens, updating authorization server metadata, and testing the end-to-end flow. ### Source excerpt If you currently federate enterprise customers using OpenID Connect (OIDC) and want to allow applications to access your API on behalf of those users, this Cross App Access (XAA) guide is for you. The Identity Assertion Authorization Grant specification, the basis of XAA, was designed with OIDC in mind. Your authorization server already trusts the customer's IdP for single sign-on (SSO), and XAA reuses that same trust for API access. This guide details what you need to support, how to validate the grant, and how to resolve the user at your resource authorization server. Table of Contents How XAA in OIDC works Analyzing the ID-JAG claims XAA implementation checklist for OIDC-federated applications Mapping user identity from iss and sub Validating the ID-JAG and resolving the user Issuing the access token Updating authorization server metadata Making cross-application requests from your OIDC app securely Configure your XAA OIDC Resource app in Okta Create the OIDC requesting app for testing Create the OIDC resource app in Okta Register and configure the AI Agent in Okta Verify your Okta XAA setup on xaa.dev Configure OIDC SSO Verify the refresh token exchange for an ID-JAG token Redeem the ID-JAG for an access token at the resource authorization server Call the resource API with the access token Prove the XAA connection end-to-end Takeaways for implementors who also have SAML apps Learn more about Cross App Access, OIDC, and OAuth 2.0 How XAA in OIDC works When an agent (like one running in Claude) needs API access, it presents an Identity Assertion Authorization Grant (ID-JAG). The ID-JAG is a short-lived JSON Web Token (JWT) issued by the customer's Identity Provider (IdP) for your authorization server. Your resource server accepts the token, identifies the user, and issues your own access token, all while leaving the customer's existing OIDC integration untouched. The sequence diagram shown below describes the OIDC XAA flow. Notice that the OIDC SSO flow stays the ## Auth0 Enterprise Connect in beta vs. WorkOS for enterprise SSO and SCIM DevFeed: [Auth0 Enterprise Connect in beta vs. WorkOS for enterprise SSO and SCIM]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-21T00:00:00Z Content type: comparison Language: en Sources: [WorkOS Blog]() Topics: [Auth0](), [Single sign-on (SSO)](), [Provisioning](), [OpenID connect (OIDC)](), [saml](), [Security]() Tags: [auth0](), [enterprise](), [oidc](), [provisioning](), [saml](), [sso]() ### AI overview This comparison examines Auth0 Enterprise Connect, which is in beta, alongside WorkOS for enterprise SSO and SCIM. It explains how Auth0 preserves an existing authorization server while adding enterprise identity capabilities, and highlights differences in SCIM direction, plan tier, pricing, and access requirements. ### Source excerpt Auth0's beta keeps the authorization server you already run and adds the enterprise surface around it. The differences from WorkOS show up in SCIM direction, plan tier, and which pricing table you are actually reading. ## How to add enterprise SSO to an Express.js API DevFeed: [How to add enterprise SSO to an Express.js API]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-21T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [Single sign-on (SSO)](), [Tutorial](), [Express](), [Node.js](), [API](), [JSON Web Tokens](), [OpenID connect (OIDC)](), [Authorization](), [Back end]() Tags: [api](), [authorization](), [how-to](), [js](), [jwt](), [middleware](), [node-js](), [oidc](), [security](), [sso]() ### AI overview A step-by-step tutorial for adding enterprise SSO to an Express.js API with WorkOS. It covers SAML and OIDC login redirects, callback handling, JWT verification on protected routes, and multi-tenant authorization using signed token claims. ### Source excerpt Add enterprise SSO (SAML and OIDC) to an Express.js API with WorkOS. Step-by-step Node.js code for the login redirect, the callback, and JWT verification on protected API routes. ## Product Release Notes - July 2026 DevFeed: [Product Release Notes - July 2026]() Original publisher: [Read original article]() Author: Matan Grady Published: 2026-08-20T08:13:19Z Content type: release Language: en Sources: [Developer Experience & Platform Engineering Blog | Port]() Topics: [AI Agent](), [Artificial Intelligence](), [Claude](), [anthropic](), [dashboards](), [Model Context Protocol](), [sdlc](), [Single sign-on (SSO)](), [pull-requests]() Tags: [2026](), [agent](), [agentic](), [agents](), [ai](), [ai-agent](), [anthropic](), [claude](), [dashboards](), [events](), [integration](), [integrations](), [mcp](), [product](), [product-release](), [pull-requests](), [release](), [release-notes](), [sdlc](), [workflows]() ### AI overview Port's July 2026 release notes describe expanded Port AI capabilities for planning and executing approved platform changes. The release adds agentic catalog actions, Ask, Plan, and Build modes, dashboard creation tools, inline integration setup, structured clarifying questions, visible reasoning, Claude Managed Agents integration, conversational onboarding, Survey Intelligence, and end-to-end SSO administration. ### Source excerpt July brings Port AI's biggest step yet toward taking action on your behalf -- from an AI Agent that can create blueprints and trigger workflows, to AI-guided conversational onboarding that sets up new orgs automatically, plus a brand new way to capture team sentiment with Survey Intelligence. Here's everything that's new in Port this month. ## Enterprise Managed Users is now generally available DevFeed: [Enterprise Managed Users is now generally available]() Original publisher: [Read original article]() Author: Bel Curcio Published: 2026-08-11T20:38:00Z Content type: release Language: en Sources: [Vercel News]() Topics: [Vercel](), [Single sign-on (SSO)](), [Authentication](), [Provisioning]() Tags: [authentication](), [docs](), [enterprise](), [identity](), [provisioning](), [sign-in](), [sso](), [updates](), [vercel]() ### AI overview Vercel Enterprise Managed Users is now generally available, giving organizations centralized control over accounts on verified domains through SAML SSO, Directory Sync, and IdP-managed profiles. ### Source excerpt Enterprise Managed Users (EMU) gives organizations full control over the Vercel accounts tied to their verified domains. It makes the organization's identity provider the single source of truth for authentication and account lifecycle, so accounts on company domains are governed centrally rather than owned by individuals. Now generally available IdP-enforced sign-in: Managed users sign in through SAML SSO only. All other login methods, including email OTP, GitHub, Google, and GitLab, no longer work for managed accounts. SCIM provisioning & lifecycle: Directory Sync creates, updates, and deprovisions managed users automatically, keeping accounts in sync with your IdP. Owned by your organization: Profile settings are managed through your IdP rather than by the individual. Self-serve enablement: Turn EMU on for a verified domain in Team Settings under Security & Privacy, and extend it across multiple eligible teams in a single step. Requires an Enterprise plan, enforced SAML SSO, active Directory Sync, and at least one verified domain. In Beta, available on request Hobby team transition: Members with an existing personal account on a newly managed domain are guided to add a personal email (keeping their hobby projects) or delete the account, then continue to their work through SSO. Automatic conversion: Personal accounts with no content or activity are archived automatically, and their owners land in a new managed account at their next SSO sign-in. To request access, contact your account team. Learn more in the Enterprise Managed Users and Hobby team transition docs. Read more ## Sign in with ChatGPT is in beta on Supabase DevFeed: [Sign in with ChatGPT is in beta on Supabase]() Original publisher: [Read original article]() Author: Cemal Kılıç; Gregor Vand Published: 2026-07-29T07:00:00Z Content type: article Language: en Sources: [Supabase Blog]() Topics: [Supabase](), [ChatGPT](), [Single sign-on (SSO)](), [OpenAI](), [codex](), [Databases]() Tags: [auth](), [chatgpt](), [codex](), [databases](), [developers](), [github](), [identity](), [openai](), [partner](), [partnership](), [web]() ### AI overview Supabase introduces beta support for signing in with a ChatGPT account. Users can create or link Supabase accounts, connect Supabase through ChatGPT and Codex, review plugin permissions, and revoke access from the Supabase Dashboard. ### Source excerpt Use your ChatGPT account to sign in to Supabase, and connect Supabase inside ChatGPT and Codex. ## 1Password is a Leader in the 2026 Gartner® Magic Quadrant™ for SaaS Management Platforms DevFeed: [1Password is a Leader in the 2026 Gartner® Magic Quadrant™ for SaaS Management Platforms]() Original publisher: [Read original article]() Author: info@1password.com (1Password) Published: 2026-06-23T00:00:00Z Content type: article Language: en Sources: [Blog on 1Password Blog]() Topics: [SaaS Management](), [shadow AI](), [MCP Server](), [OAuth](), [Single sign-on (SSO)](), [Security]() Tags: [agents](), [ai](), [ai-agents](), [mcp-server](), [oauth](), [saas](), [saas-management](), [security](), [shadow-ai]() ### AI overview 1Password announces that it has been recognized as a leader in the 2026 Gartner Magic Quadrant for SaaS Management Platforms. The article presents SaaS Manager as a way for IT and security teams to discover unapproved AI use, monitor applications and spending, identify token-budget overruns, govern access outside SSO, and automate governance workflows through an MCP Server. ### Source excerpt Recognized for Completeness of Vision and Ability to Execute 1Password has been recognized as a leader in the 2026 Gartner® Magic Quadrant™ for SaaS Management Platforms. SaaS Manager gives IT and security teams visibility into unapproved AI use and every app, AI tool, and dollar spent across their organization. This foundation lets teams identify real-time AI token overruns before mid-year budget surprises hit, cut wasted license spend, and reduce friction for employees requesting access. The platform closes the access gaps that happen outside of SSO, governing human access across the full employee lifecycle and enabling AI agents to automate governance workflows through an MCP Server. We believe our placement in the Gartner® Magic Quadrant™ reflects our vision that with the right controls, SaaS management can help a business move faster. Get the full analysis [Read the Gartner® Magic Quadrant™ for SaaS Management Platforms](https://1password.com/resources/gartner-magic-quadrant-saas-management-platforms-2026) Identity Access Management doesn't show the full picture of AI token consumption and SaaS access Employees aren't waiting for IT approval to adopt AI. The 1Password Access-Trust Gap Report found that 27% of knowledge workers were using AI-based applications that their employer didn't approve. Coding assistants, productivity tools, and AI platforms are being connected to work accounts, granted API access, and signed in with corporate credentials, often through a single "sign in with Google" OAuth token that leaves no trace in the identity provider. IT has no record of these AI tools, no visibility into what data enters the AI's context window, and no way to revoke access. When those tools run on consumption-based pricing, annual AI token budgets are being depleted within months, with no signal to finance until the allocation is nearly gone. SaaS sprawl has been a known cybersecurity problem for years, and until recently, traditional identity management was suf ## Mapping out your unknown: A threat hunter's guide to Salesforce DevFeed: [Mapping out your unknown: A threat hunter's guide to Salesforce]() Original publisher: [Read original article]() Author: Julie Agnes Sparks Published: 2026-06-16T00:00:00Z Content type: article Language: en Sources: [Datadog Security Labs]() Topics: [Security](), [Reconnaissance](), [Software as a service](), [OAuth](), [Single sign-on (SSO)](), [MFA](), [API](), [log management](), [Monitoring]() Tags: [api](), [data](), [guide](), [logging](), [monitoring](), [oauth](), [post](), [saas](), [salesforce](), [security](), [tokens]() ### AI overview A threat-hunting guide to Salesforce that describes common attack paths, including compromised OAuth applications, stolen SSO and MFA credentials, resource discovery, data extraction, and ransomware. It provides detection queries and explains how Salesforce audit logging tiers support investigation, with queries mapped to MITRE ATT&CK tactics. ### Source excerpt In this post, we walk through different threats to Salesforce and how to detect them. ## How to Eliminate Shared Database Passwords: MySQL, PostgreSQL, and More DevFeed: [How to Eliminate Shared Database Passwords: MySQL, PostgreSQL, and More]() Original publisher: [Read original article]() Author: info@goteleport.com (Dan Johns) Published: 2026-06-05T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [Databases](), [MySQL](), [PostgreSQL](), [certificates](), [passwords](), [Single sign-on (SSO)](), [audit](), [Authorization]() Tags: [apply](), [audit](), [certificates](), [credentials](), [cryptographic](), [database](), [how-to](), [mysql](), [passwords](), [permissions](), [policy](), [postgresql](), [sso]() ### AI overview A guide to replacing shared database passwords and standing privileges with short-lived certificates and identity-based access. It explains how Teleport supports MySQL, PostgreSQL, and other databases, including role-based permissions, hardware-key approval for writes, and query-level attribution in audit logs. ### Source excerpt Learn how to access MySQL, PostgreSQL, and other databases using short-lived certificates instead of shared passwords. ## The unmanaged stack: Governing SaaS apps and AI tools outside SSO DevFeed: [The unmanaged stack: Governing SaaS apps and AI tools outside SSO]() Original publisher: [Read original article]() Author: info@1password.com (Rachel Sudbeck) Published: 2026-05-29T00:00:00Z Content type: article Language: en Sources: [Blog on 1Password Blog]() Topics: [Artificial Intelligence](), [Software as a service](), [Single sign-on (SSO)](), [IAM](), [Security](), [ChatGPT](), [Claude](), [cursor]() Tags: [ai](), [ai-tools](), [chatgpt](), [claude](), [cursor](), [enterprise](), [iam](), [saas](), [saas-management](), [security](), [supply-chain]() ### AI overview This article recaps a 1Password webinar about governing SaaS applications and AI tools that operate outside traditional SSO and IAM controls. It describes the unmanaged stack, its governance and supply-chain risks, and 1Password integrations intended to help teams discover, review, and govern high-risk accounts and usage. ### Source excerpt Note: This blog is a recap of 1Password's recent webinar, "The unmanaged stack: Governing SaaS apps and AI tools outside SSO." Head here to watch the complete webinar recording. In the constantly evolving world of enterprise tech, there's one thing that IT and security teams have always been able to count on: users won't follow policy if they think it's standing in the way of their productivity. Case in point: 1Password's most recent annual report found that 52% of employees have downloaded apps without IT approval. These shadow IT apps typically sit outside a company's SSO provider, and introduce both unmanaged risk and cost. That governance gap has become more pressing with the growing adoption of AI tools and agents, which introduce new and worsening threats. This issue was the focus of 1Password's recent webinar, "The unmanaged stack: Governing SaaS apps and AI tools outside SSO." What is the unmanaged stack? It refers to all of the SaaS apps and AI-based tools that can't be managed by traditional IAM tools, whether that's due to software constraints or the infamous "SSO tax." During the webinar, Evan Sandhu, 1Password Product Marketing Specialist, and Ethan Stoler, Senior Demo Engineer, explored how 1Password's solutions can help IT and security teams secure and govern these unapproved or unmanaged access points. Key takeaways from the webinar: SaaS and AI tools outside SSO create governance blind spots and can introduce supply chain risk. 1Password SaaS Manager helps discover unmanaged SaaS and AI usage, and help IT teams centralize provisioning, auditing, and lifecycle management. New integrations within 1Password support governance for ChatGPT, Claude, Cursor, and Gemini. Read on for an in-depth recap of the webinar's key themes. New integration features to manage high-risk SaaS and AI IT and security teams need solutions to manage those apps that fall outside the purview of SSO. Thankfully, new integrations between 1Password Enterprise Password Manager (EPM ## Announcing Keycloak's Identity Summit: KEYCONF26 DevFeed: [Announcing Keycloak's Identity Summit: KEYCONF26]() Original publisher: [Read original article]() Author: Nathalia Pinesi, Alexander Schwartz Published: 2026-05-02T00:00:00Z Content type: article Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [IAM](), [identity and access management](), [OAuth 2.0](), [OpenID connect (OIDC)](), [Single sign-on (SSO)](), [Kubernetes](), [Security]() Tags: [2026](), [conference](), [identity](), [identity-and-access-management](), [idm](), [implementation](), [kerberos](), [keycloak](), [kubernetes](), [ldap](), [oauth2](), [oidc](), [openid-connect](), [saml](), [security](), [sso](), [summit]() ### AI overview Keycloak announces KEYCONF26, its annual Identity Summit for the Keycloak user community, taking place in Prague on October 8, 2026. The event will feature interactive sessions, practical discussions, networking, and a call for speakers and sponsors. ### Source excerpt Our annual conference dedicated to the Keycloak user community returns, with even more content and networking opportunities than last year. It's the perfect place to interact, learn, share, and exchange insights and real-world use cases, network with fellow experts, users, and contributors. 📍 Introducing KEYCONF26 - taking place in Prague on October 8th, 2026! This year's edition of the Keycloak Identity Summit features interactive sessions, and even more opportunities to engage with the people shaping the future of identity and access management. Call for sessions The call for sessions is open until May 24th, 2026 -- we'd love to hear from you! We're looking for sessions on topics such as: Keycloak deployment and operations at scale Human and non-human identities in the world of AI OAuth2, OIDC, and evolving identity standards Security best practices and hardening EU Digital Identity Wallets and eIDAS Migration stories and real-world use cases Extending and customizing Keycloak Submit your proposal now! What to expect at KEYCONF26 Inspiring Keynote Speaker Hear from Hannah Short, Team Lead for Identity and Access Management at CERN, how they are using Keycloak as a highly performant and reliable SSO running on Kubernetes. Connect with like-minded professionals From long-time contributors to those just starting their IAM journey, KEYCONF26 is the perfect place to meet others working with identity, OAuth2, OIDC, and more. Networking lunch Our extended lunch break is designed to help you meet fellow attendees, swap ideas, and build meaningful professional connections in a relaxed setting. Business drinks Stick around after the last session for informal networking over drinks. Want to sponsor this year's Business Drink? Get in touch with us--we'd love to partner with you! Expert sessions and real-world use cases Gain practical insights into Keycloak implementation, security improvements, OAuth2 best practices, and evolving identity standards. Learn how to use EU Digital ## Custom OIDC Providers for Supabase Auth DevFeed: [Custom OIDC Providers for Supabase Auth]() Original publisher: [Read original article]() Author: Cemal Kılıç Published: 2026-04-08T07:00:00Z Content type: release Language: en Sources: [Supabase Blog]() Topics: [OpenID connect (OIDC)](), [Supabase](), [Authentication](), [OAuth 2.0](), [Single sign-on (SSO)](), [GitHub]() Tags: [auth](), [authentication](), [compliance](), [external](), [identity](), [oauth](), [self-hosted]() ### AI overview Supabase introduces Custom OIDC Providers, enabling projects to connect standards-compliant external OpenID Connect identity providers. The feature supports automatic discovery and token verification, familiar sign-in flows, dashboard configuration, and PKCE by default. ### Source excerpt Connect any OpenID Connect identity provider to your Supabase project: GitHub Enterprise, regional providers, and more. [Next page]()