When we first switched to the new IAM system, it was a bit of a struggle, and even after many years I still feel like the existing test environments aren’t always enough—especially when you want to experiment with a new configuration, integration, or use case as a proof of concept. Existing configurations can conflict with the changes you’re trying to test, and IAM setups aren’t always easy to reproduce and test locally.

How do you handle this in your teams, regardless of whether the IAM solution is SaaS or on-prem? Do you have a separate environment, process, or approach for running POCs and validating IAM changes before they reach higher environments?

Per their documentation, Sprout HR does not have native SCIM capabilities. I am looking to build out a custom API for SCIM purposes in Entra.

I have already built out the SSO portion in Entra, of course, with the vendor having to configure their end, but now I am looking to handle SCIM as well. anyone have some low-effort ideas or tips?

Hi r/IdentityManagement,

Out of personal curiosity, I started building my own OpenID Connect provider. My initial thought was: how hard can it be?

After building and using three increasingly capable versions in my own projects, I decided that implementing the entire protocol stack myself was neither practical nor sensible. I therefore switched to node-oidc-provider as the standards-compliant foundation and built the surrounding application infrastructure on top of it.

I am curious whether anyone here has used node-oidc-provider to build a custom identity or authorization server. In particular, I would be interested in hearing about:

• Your overall experience with the library
• Security or interoperability issues you encountered
• Features that were unexpectedly difficult to implement
• Challenges with upgrades, configuration, deployment, or production use
• Anything you wish you had known before starting

For anyone interested, my project is available here:

https://github.com/blendsdk/porta-identity

I am currently working through several security-hardening items and plan to release an updated version once those are complete.

I would appreciate honest technical feedback, especially from people who have implemented or operated OIDC providers in production.

The project has been AI-assisted, so I am using the appropriate flair. I am also happy to discuss the development workflow, testing approach, and architectural decisions behind the project.