Access and Identity Management

Architect of zero-trust security postures, SSO, AIM, and the hardened access controls required to safeguard production systems and cloud infrastructure.

Overview

Security-first infrastructure principal focused on the end-to-end design and implementation of Access and Identity Management (AIM) architectures. I do not invent security, I coherently deploy the leading protocols, preferably using open source implementations. My approach treats authorization policies as code: with constant operational governance to assure the estate against these.

Directory Architecture and Provisioning

I have great affection for LDAP and base much of my authentication upon 389 DS. I have considerable expertise building API and Web authentication handlers around X509/PKI and a plethora of popular back end authentication services assuring both SSO and security posture.

Federated Authentication and Protocols

I build high-integrity identity federation interfaces using the ipsilon server stack to architect secure single sign-on bridges across hybrid infrastructure, linking open source systems with legacy Microsoft Active Directory (AD) realms and cloud-native Microsoft Entra ID environments. I deploy mod_auth_mellon with the underlying lasso library for SAML 2.0 federation, mod_auth_openidc for decoupled OpenID Connect and OAuth2 service engines, and mod_auth_gssapi alongside freeipa-server to govern cross-realm Kerberos trust boundaries without fragile synchronization scripts.

Identity Lifecycle and Automated PKI

I construct fully internal, hardened Public Key Infrastructures (PKI) using Step CA and softhsm cryptography abstractions, driving automated validation checks with Step CA. By offloading identity caching, host credential verification, and dynamic hbac rules natively to the System Security Services Daemons, I replace manual certificate rotation tasks with deterministic, secure, policy based automation.

An example of this is my Entitlements Server for RHSMD, the backbone of commercial BastionLinux.