Cloud Security · New Zealand
Standing up an enterprise identity platform under a regulatory deadline
When the company I worked for was carved out of its former parent after a public listing, we did not just need new infrastructure. We needed a new identity, in the literal sense. Every system authenticated through the parent’s identity provider, and on a regulatory deadline, all of it had to move to an identity platform we owned, without locking anyone out along the way.
I designed and delivered that platform on Okta, end to end and single-handedly. The architecture, every integration decision, the migration sequence and the accountability for no one being locked out were all mine. It is the piece of the separation I would point to first when someone asks what “hard” looks like in this work, because identity is where security, user experience and every other system meet.
Why identity is the thing you cannot fake
You can migrate a data platform quietly. You can replace a gateway behind the scenes. You cannot quietly replace the thing every employee uses to log in every morning, and every application trusts to say who someone is.
Identity is load-bearing for the entire estate. Get it wrong and the failure mode is not a degraded dashboard, it is people unable to work and applications unable to authenticate anyone. On a compliance deadline, with no option to simply extend the parent’s arrangement, that raised the stakes on every decision, and every one of those decisions was on me.
Building the platform, not just buying the licence
Standing up Okta was the easy sentence and the hard work. End to end, and all of it my design, meant:
- Procurement and tenancy, established from nothing as an independent environment.
- Directory integration. Active Directory wired in as the authoritative source of identity, so accounts and lifecycle flowed from one place rather than being re-keyed.
- Application onboarding, one integration at a time, using SAML for the applications that spoke it and OIDC for the modern ones.
- Multi-factor authentication and conditional access, so the new front door was stronger than the old one rather than merely different.
A platform is not the product you buy. It is the integrations, the directory of record, the policies and the lifecycle you build around it, and I built all of it.
SAML and OIDC, in practice
The two protocols are not interchangeable, and a real estate needs both. Knowing which one I was working with, and why, was part of owning the design.
SAML is the older, XML-based standard that a great deal of enterprise software still speaks, and often speaks exclusively. When an application only supported SAML, that is the integration I did, carefully, because the details of assertions and certificates are where these things break.
OIDC is the modern layer on top of OAuth 2.0, lighter and better suited to newer applications and anything with a mobile or single-page front end. Where an application supported it, I chose it.
The job is not to pick a favourite. It is to meet each application where it is, and to know which protocol you are debugging when an assertion or a token does not do what you expected.
Migrating without locking anyone out
The rule was no disruption, and I owned that outcome. So I ran the migration in parallel rather than as a single switch. I moved applications to the new identity platform one at a time, each with a way back if it misbehaved, rather than betting the whole workforce on a single cutover working first try.
An identity migration is a program of many small, reversible cutovers, not one big one. The moment it becomes one big one, you have built a single point of failure across everyone who logs in.
I rolled multi-factor authentication out in phases with clear communication, because the fastest way to turn a security improvement into a revolt is to surprise people with it at the login screen on a Monday.
What it returned
An independent identity platform, delivered on schedule inside the regulatory separation, with no service disruption, and roughly NZD 456,000 avoided against the professional-services cost that had been quoted to deliver it. I delivered on my own what had been priced as a consulting engagement. More importantly, the new estate stood on identity infrastructure I had designed and understood, rather than a dependency on the company we had just separated from.
The lesson
Identity is a program, not a task, and it needs one person clearly accountable for it. Sequence it by risk, keep every cutover small and reversible, and treat SSO as the place where security and user experience are the same conversation rather than competing ones. Done well, the people relying on it never notice the ground moving underneath them, which on an identity migration is the highest compliment the work can get.
This is one of the selected career impact stories on my home page. More engineering work, including tiaki, is on GitHub.