Identity

Thirty lines of nginx boilerplate per service, copied nine times, so any improvement meant nine edits. Caddy does it in two, and writing that up is what made me spot a hop left in cleartext.

Nine self-hosted services, nine login forms, nine passwords in my manager under slightly different names. I put an identity provider in front of all of them on a thin client, and published it to every interface on the box without noticing.

Flipping msDS-SupportedEncryptionTypes is one line. I have never once been nervous about the line. I am nervous about the call two days later: a nightly job stopped, and nobody can say why. The attribute is trivial. The blast radius is not.

A report-only CA policy, and one question: if I enable it, who stops being able to work? What If gave me thirteen rows and no answer. So I wrote a PowerShell module that folds them into one.

A fresh Okta trial org is empty. The licence caps you at ten active users, so I built a lab where 8 awkward users plus everything Okta doesn’t cap does the work. Seeds in 2 min, tears down safely.

Deleting an AD account does not remove the security references pointing at it; they sit in ACLs as orphaned SIDs. An over-engineered PowerShell solution to find them at scale, with batching, logging and full test coverage.

Kerberoasting depends on RC4 still being available. How to inventory encryption types across the domain and automate the move to AES without locking anyone out.

I setup Lokka, an MCP agent created by the great Merill Fernando, and demonstrate how easy it is to get data within VSCode from a tenant using natural language queries.

Stuck with a Legacy web app that doesn’t work with SAML/OAUTH/OIDC? I show how to set credentials so the app can be launched and logged into from myapps.microsoft.com.

Showing how to authenticate into Proxmox with Microsoft SSO.