Zero-Trust Identity Platform for Enterprise SSO

The Challenge

A 5,000-employee enterprise was managing credentials across 40+ SaaS applications with no centralised identity provider. Each application maintained its own user database, password policy, and MFA configuration. The security team was processing 200+ password reset tickets per week and had recorded 48 confirmed account takeover (ATO) incidents in the previous year — primarily through credential stuffing attacks using passwords leaked from third-party breaches.

Our Approach

We deployed a zero-trust identity broker built on Keycloak, extended with custom SPIs for risk-based authentication and FIDO2 WebAuthn support.

Protocol Support: The broker supports SAML 2.0 and OIDC, covering all 40+ applications. Legacy applications that only supported LDAP were proxied through an LDAP-to-OIDC gateway. Each application was integrated over a 2-week sprint, starting with the highest-risk applications (email, file storage, HR system).

Passwordless Authentication: We rolled out FIDO2 security keys (YubiKey 5 series) to all employees and implemented platform authenticator support (Touch ID, Windows Hello) as fallback. Passwords were eliminated entirely for 92% of users within 4 months. The remaining 8% (shared service accounts, legacy kiosk systems) use rotating machine credentials managed by HashiCorp Vault.

Risk Engine: Every authentication attempt is scored in real-time based on device posture (MDM enrollment, OS patch level, disk encryption), network context (corporate VPN vs public IP, geo-location), and behavioural signals (typing cadence, time-of-day patterns). High-risk scores trigger step-up authentication or session denial.

Results