Awais Ali, home

Case study

All work

Enterprise single sign-on for 100,000+ users

High-availability single sign-on across a group of products, on Keycloak with custom Java modules and authentication flows, scaled to 100,000+ users at 99.9% uptime.

Role
Solution architect
Domains
Single sign-onOIDC · SAML · SCIMLDAP
Single sign-onOIDC · SAML · SCIMLDAP
Illustrative concept, not a product screenshot
Contents

Context

A group of products needed one identity: a single sign-on for users across all of them, and one place to manage it, with a legacy identity system already in place.

Constraints

  • High availability, at 99.9% uptime.
  • Scale: 100,000+ users, with game launches and user surges.
  • Standards: OAuth 2.0, OIDC, SAML and SCIM.
  • A legacy identity and authorisation system that had to keep working.
  • Product-specific sign-in, built as custom authentication flows.

Architecture

Enterprise single sign-on for 100,000+ users
Enterprise single sign-on for 100,000+ users Components by lane. Products: The group's products; Game and metaverse platform (100+ games). Protocols: OAuth 2.0 / OIDC; SAML; SCIM provisioning. Identity platform (Kubernetes): Keycloak cluster (high availability); Custom Java modules; Custom authentication flows. Legacy: Legacy identity and authorisation system. Flows: The group's products to OAuth 2.0 / OIDC; Game and metaverse platform to OAuth 2.0 / OIDC; The group's products to SAML; OAuth 2.0 / OIDC to Keycloak cluster; SAML to Keycloak cluster; SCIM provisioning to Keycloak cluster; Custom Java modules to Keycloak cluster; Custom authentication flows to Keycloak cluster; Keycloak cluster to Legacy identity and authorisation system (LDAP). Products Protocols Identity platform (Kubernetes) Legacy The group's products Game and metaverse platform 100+ games OAuth 2.0 / OIDC SAML SCIM provisioning Keycloak cluster high availability Custom Java modules Custom authentication flows Legacy identity and authorisation system LDAP Enterprise single sign-on for 100,000+ users Components by lane. Products: The group's products; Game and metaverse platform (100+ games). Protocols: OAuth 2.0 / OIDC; SAML; SCIM provisioning. Identity platform (Kubernetes): Keycloak cluster (high availability); Custom Java modules; Custom authentication flows. Legacy: Legacy identity and authorisation system. Flows: The group's products to OAuth 2.0 / OIDC; Game and metaverse platform to OAuth 2.0 / OIDC; The group's products to SAML; OAuth 2.0 / OIDC to Keycloak cluster; SAML to Keycloak cluster; SCIM provisioning to Keycloak cluster; Custom Java modules to Keycloak cluster; Custom authentication flows to Keycloak cluster; Keycloak cluster to Legacy identity and authorisation system (LDAP). Products Protocols Identity platform (Kubernetes) Legacy The group's products Game and metaverse platform 100+ games OAuth 2.0 / OIDC SAML SCIM provisioning Keycloak cluster high availability Custom Java modules Custom authentication flows Legacy identity and authorisation system LDAP
Components and flows

Components

Products
The group's products
Game and metaverse platform (100+ games)
Protocols
OAuth 2.0 / OIDC
SAML
SCIM provisioning
Identity platform (Kubernetes)
Keycloak cluster (high availability)
Custom Java modules
Custom authentication flows
Legacy
Legacy identity and authorisation system

Flows

  • The group's products to OAuth 2.0 / OIDC
  • Game and metaverse platform to OAuth 2.0 / OIDC
  • The group's products to SAML
  • OAuth 2.0 / OIDC to Keycloak cluster
  • SAML to Keycloak cluster
  • SCIM provisioning to Keycloak cluster
  • Custom Java modules to Keycloak cluster
  • Custom authentication flows to Keycloak cluster
  • Keycloak cluster to Legacy identity and authorisation system (LDAP)
  • Keycloak on Kubernetes, highly available.
  • Custom Java modules that extend Keycloak, and custom authentication flows.
  • Legacy integration: the existing identity and authorisation system, bridged into Keycloak through LDAP.
  • Protocols: OAuth 2.0, OIDC and SAML for sign-in, SCIM for provisioning.
  • Consumers: the group's products, including the game and metaverse platform and its 100+ games, which signed in through it.

Key decisions

  1. A legacy identity system already existed. Rather than rebuild it, I moved sign-in to Keycloak with custom modules and bridged the legacy authorisation system in through LDAP.

  2. Keycloak started on a fixed pair of servers. Game launches and user surges needed horizontal scaling, so I moved it to Kubernetes.

My role

I was the solution architect: I owned the requirements, the architecture and the technology decisions and oversaw the engineering. I architected the custom modules and built several of them myself.

Outcome

Single sign-on for 100,000+ users at 99.9% uptime, and the sign-in layer for the game and metaverse platform and its 100+ games.

Stack

Each links to its entry on the stack page

Ask about this

How was single sign-on built for 100,000+ users?

Answers come from the content on this site.

The chat needs JavaScript. Without it, ask through the contact page.