Guilliano

🛡️ Helping devs use Keycloak as a service at Skycloak
🥋 Also love to strangle people in the evening... 👌

[Guilliano @thegmol]

@PromptToProdApp Also price enterprise SSO connections and SCIM. B2B apps hit those long before 100K users, and per-user pricing looks very different once SSO is billed separately

[Guilliano @thegmol]

@BleepinComputer Feb 2027 is close for anyone with frontline staff on shared devices. Plan recovery first: what happens when someone loses their only passkey on a Monday morning?

[Guilliano @thegmol]

@AliMalekli Add a fourth question: if one agent hands work to another, does the second get less access or the same? NIST's tenet 2 says less. Most setups today just pass the user's token along

[Guilliano @thegmol]

@cyber_rekk The real failure is the 2012 test account nobody owned. Owner plus expiry on every account, and a quarterly sweep for anything that hasn't logged in

[Guilliano @thegmol]

@thedealdirector Federated, short-lived creds would have made this a much smaller week for their customers

[Guilliano @thegmol]

@miguelamigot Useful list! How many of the 44 without MCP still need a service account with broad scopes. In education, that could be where the risk hides, not necessarily in the agent

[Guilliano @thegmol]

@davidmytton Plus one. We shouldn't forget who the agent acts for. Short-lived and traceable is half of it. The token should also say which user delegated it and what it's limited to

[Guilliano @thegmol]

@andrewqu Agree, and the same pattern works for B2B apps calling each other. The blocker is not tech, it's that the receiving side has no trust policy UI, so customers fall back to 'generate API key'

[Guilliano @thegmol]

@connacher_ Most MCP auth trouble I see is client and server disagreeing on discovery. Worth checking that the protected resource metadata and the authorization server metadata both resolve before blaming the client

[Guilliano @thegmol]

@BjarnBronsveld @LettermintCo Love this. Are you doing SCIM too, or just login for now? How will you handle deprovisioning?

[Guilliano @thegmol]

@typeangled Spot on about auth. SAML is usually expected from people. SCIM deprovisioning and the security questionnaire are surprising asks to prove it works

[Guilliano @thegmol]

@alitajran We've seen this movie. Default-open app registrations is how companies ended up with hundreds of OAuth apps nobody owns

Agents need an owner from day 1, not after a painfull audit

[Guilliano @thegmol]

@mahdi SSO isn't expensive to turn on. It's expensive to support

Every customer IdP is a bit different. Certs expire. Their Okta admin quits. Someone maps the wrong group to admin

Kill the SSO tax, I'm for it. Just budget for support

[Guilliano @thegmol]

@CartuneNetwerk They are investors. That’s good retirement money when AI will make the movies 😉

[Guilliano @thegmol]

@brankopetric00 Agreed. We use k8s and it’s great for our use case (keycloak managed hosting) and removing it from the picture would be very painful. You have to make sure it does solve a legitimate problem with ROI in mind and we have enough stories nowadays to see its pros and cons

[Guilliano @thegmol]

@forked_franz @QuarkusIO @keycloak Yeah. I also see it being used in local government branches for their online tools here

[Guilliano @thegmol]

@julioc And if you don’t want to manage it yourself, we can do that for you

[Guilliano @thegmol]

@Jason Valid fear, but why haven’t OpenAI destroyed Anthropic yet? This seems like a marketing issue than anything. Microsoft was able to dominate because their competitors couldn’t provide a clear value to their customers. We use Google everyday and they don’t put us out of business

[Guilliano @thegmol]

@zadextroyer Is this for your own project?

[Dev Hunt @devhunt_]

Skycloak is a managed Keycloak service that simplifies identity and access management (IAM) for developers and businesses.

⇨ It provides Keycloak’s robust features without the complexity of managing infrastructure.

Learn more фищге @skycloakio on Dev Hunt:
→ https://t.co/P5RaZ55hHn