Custom Identity Provider Implementation
We built a custom identity provider for customer portals. An identity provider (IdP) manages sign-in and confirms a user's identity to connected services. The aim was one customer account across the main site, account area and support portal.
What we implemented
- Single sign-on (SSO), so users can move between connected services with one login.
- OAuth 2.0 and OpenID Connect, standard protocols for access and sign-in.
- User data sync for services that needed more than the standard sign-in flow.
- Detailed authentication logs to review integrations and investigate sign-in problems.
We also implemented signed sign-in tokens in the format required by a support platform. This gives the provider a way to support service-specific requirements without replacing the shared login system.
Why own the provider?
We can choose what gets logged and change integration rules directly. This helps us check client setup, diagnose errors and support the teams connecting their services. We can also add token formats for services with unusual requirements.
Security still depends on correct sign-in flows, keeping secrets on the server and regular review.
Custom IdP or Okta/Auth0?
| Option | Benefits | Trade-offs |
|---|---|---|
| Custom IdP | Direct control over sign-in rules, logs, data hosting and service-specific integrations. | Build and running costs. Your team owns updates, security reviews, uptime, account recovery and the keys used to sign tokens. |
| Okta or Auth0 | Ready-made sign-in features, integration tools and a platform operated by the vendor. | Recurring fees and product limits. Custom integrations still need development and review. |
Managed providers also offer logs and customization. See Okta monitoring, Auth0 logs and Auth0 Actions.
Our recommendation: use Okta or Auth0 when their standard features cover the job. Choose a custom IdP when integration or hosting requirements justify the build and ongoing support.
Plan your identity provider implementation
Send us the services you need to connect. We'll compare custom and managed options, then scope the implementation and support.