In this blog, Iām summarizing key concepts and ideas i take way from book āBuilding Multi-Tenant SaaS Architecturesā by Tod Golding, which I started reading while working on Tenant Management System at Money Forward.
NIST SP 800-63A-4 is the identity proofing volume of the 800-63-4 suite. It defines exactly what “verified identity” means at each assurance level, what evidence qualifies, how to handle the cases that break the happy path, and what your fraud program needs to look like.
Most engineers think about identity in two terms: the user is authenticated or they aren’t. If you’ve built a login system, you’ve probably made decisions like “we’ll require MFA for sensitive actions” or “we’ll use SSO”. Those are reasonable decisions, but they’re incomplete.
SAML is old, verbose, and XML-based. Every engineer who encounters it for the first time wishes the world had just used OIDC instead. But SAML isn’t going anywhere. If you work on identity in an enterprise context, you’ll integrate with it whether you want to or not.
