Topic
9 matching entries across Articles, TIL and Projects.
Long-form writing tagged Identity.
Authentication proves identity, but it does not prove a user has met a business requirement. I used Cloudflare Access External Evaluation, Workers and D1 to add training compliance to the access decision.
A safe pattern for automating PKI inventory, expiry monitoring, CA health checks, maintenance evidence and certificate lifecycle tasks without hiding risk.
A practical implementation sequence for SAML SSO in Microsoft Entra ID, including claims, assignments, certificate lifecycle, testing and rollback.
Practical lessons from an enterprise ZTNA deployment: foundations, staged migration, policy automation, legacy applications, change management, and measurement.
Use events 4740 and 4625 together to move from 'the account keeps locking' to a timeline that identifies the source device, logon type and stale credential.
NO_CLIENT_SITE entries in Netlogon logs are useful evidence that client networks are not mapped cleanly to Active Directory sites. PowerShell can turn the logs into a subnet-hygiene report.
Short notes and fixes tagged Identity.
For a training-compliance Access evaluator, I treat missing users, invalid requests and database errors as deny conditions instead of accidental allows.
Why Active Directory exposes multiple logon attributes and why choosing the wrong one can give misleading results.
Projects and implementation patterns tagged Identity.
An Access External Evaluation Worker that uses D1-backed training state to require mandatory training completion before protected applications can be opened.
