IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
Build vs buy for identity
The founder of QuickBite, a food-delivery startup with six engineers, says, "Login is just a form and a password check. Let's build our own." Your goal: decide between build and buy, knowing the real work behind a login.
- A login form is the tip of an iceberg of hidden work.
- You can buy a platform or run an open-source server. Both give you tested code.
- Use open standards (OIDC, SAML, SCIM) at every joint, so you can leave later.
- Build only if identity is what your product sells.
What "just build login" really means
A login form is the tip of an iceberg. Under the water is everything that makes it safe. Zara, the security lead, keeps this list on a whiteboard. The founder only pictures the form.
🔑 Credentials
Correct password hashing (slow, with a random salt). Checks against leaked passwords. In time, passkeys.
📱 MFA and recovery
Extra sign-in factors (MFA, multi-factor authentication), step-up for risky actions, and the recovery path. Weak recovery is the easiest way in (see enterprise SSO and account recovery). If customers sign in with a phone OTP, every SMS costs money. Attackers can ask for thousands of OTPs to run up your bill.
🎟️ Sessions and tokens
Issuing, rotating and revoking tokens, as in the token lifetimes lesson. A sign-out that really signs out.
🏢 Enterprise needs
SSO with OIDC and SAML. SCIM to create and remove accounts. Every enterprise buyer will hand you this checklist.
🛡️ Audit and compliance
Logs that show tampering, access reviews, rules on where data may live, and proof for auditors.
🚨 24/7 response
Someone awake when credential stuffing starts at 3 a.m. Identity is a target forever.
The QuickBite founder wants "just a login" by Friday. Zara draws the iceberg: hashing, MFA, passkeys, session revocation, SSO, SCIM, breach monitoring, audit, on-call. "Friday's form is a weekend," she says. "This is a team, forever. And none of it is what customers pay us for."
The buy or adopt path
The other way is to use tested work. You can buy a managed identity platform. Or you can run an open-source identity server yourself. Either way, you inherit years of hardening and standards support. You pay in integration work, ongoing cost and some lock-in (being stuck with one vendor). These are real costs, but not deal-breakers.
Open source swaps a vendor bill for work you own. You patch it, run it and keep it up. In return you keep full control of your user data.
The middle path: standards keep you free
Good architects rarely pick an extreme. They buy or adopt the hard parts that do not set them apart. They also use open standards at every joint, so they are never trapped. Use OIDC and SAML for sign-in. Use SCIM for accounts. Then changing provider is a migration, not a rewrite. Also keep your own copy of your user records in a format you can export. And avoid features that exist in only one product.
How to decide
Five questions settle most cases:
- Do you have dedicated security engineers who will own this for years?
- How heavy is your regulation?
- Will enterprise buyers need SSO and SCIM soon?
- How tight is your time to market?
- The deciding one: is identity what your product sells?
For almost everyone, the answer to the last question is no. Customers pay for the restaurant, the clinic or the analytics, not for your login. Build only where identity is the product.
A half-built login is a security risk and a distraction from your real product. A badly connected platform is a lock-in trap. Decide on purpose and connect with standards. Every defense in this Academy applies whether you build or buy.
Go deeper: open-source identity servers (as of October 2026)
These are examples, not a ranking. Each project's own README gives the license.
- Keycloak: Apache License 2.0. It is a CNCF incubating project. It offers single sign-on, sign-in through other providers, and user federation with OIDC, OAuth 2.0 and SAML 2.0.
- Ory (for example Kratos): Apache 2.0. Some enterprise features need a separate paid Ory license. These include SCIM, SAML and organization SSO.
- authentik: the core is MIT. Code in its
enterprisefolder has a separate license, and a paid edition exists. - ZITADEL: AGPL-3.0 by default, with Apache 2.0 or MIT for some folders. AGPL has duties if you change the code and offer it over a network. Read it first.
Licenses can change. Check the license of the version you plan to run before you commit. Also ask who patches security flaws, and how fast.
Go deeper: the cost beyond the price list
Count more than the license. For a managed platform, the bill often grows with the number of active users. Features such as SSO connections can add to it. For self-hosting, count the people who run, patch and monitor it, and the cost of an outage. For building, count the team and the audit work. Compare the cost at today's size and at 10 times that size.
Go deeper: moving later
Plan the exit on day one. SCIM is defined in RFC 7643 and 7644. If you must move millions of users without a reset storm, read user migration. A common pattern is to move each user the first time they sign in. Password hashes can move only if the new system understands the hash format.
🧪 Interactive lab — enable JavaScript to play with this one.
If you adopt a platform, check its joints. Grade an OIDC issuer's logout and revocation with Logout Check. Lint an ID token with ID Token Check.