Why OpenMediaVault Keeps Its Own Login
Last post I deleted an application login and let the proxy gatekeep. This one keeps its login, and making the proxy a real boundary took a firewall rule and a lesson about who else talks to a service.
Identity
Turning Off Tautulli's Login on Purpose
Tautulli has its own login and no way to accept an identity from a proxy. I deleted the account and let authentik be the single gate. Whether that is sensible or reckless depends on your network.
Learning Resources
A running list of the books, communities, modules, tools and certification paths I have actually used. Kept as I find things, including the ones I wish I had known about earlier.
An Identity Provider Is Supposed to Be Reachable
I put my identity provider on the internet through a tunnel, then went looking for where to put an access policy in front of it. The answer is a far smaller surface than I expected.
Forward Auth in One Snippet, and the Hop I Had Wrong
Thirty lines of nginx boilerplate per service, copied nine times, so any improvement meant nine edits. Caddy does it in two, and writing that up is what made me spot a hop left in cleartext.
Standing Up authentik on a Thin Client
Nine self-hosted services, nine login forms, nine passwords in my manager under slightly different names. I put an identity provider in front of all of them on a thin client, and published it to every interface on the box without noticing.
Knowing What Breaks Before You Turn Off RC4
Flipping msDS-SupportedEncryptionTypes is one line. I have never once been nervous about the line. I am nervous about the call two days later: a nightly job stopped, and nobody can say why. The attribute is trivial. The blast radius is not.
Conditional Access: Outcomes, Not Verdicts
A report-only CA policy, and one question: if I enable it, who stops being able to work? What If gave me thirteen rows and no answer. So I wrote a PowerShell module that folds them into one.
Seeding an Okta Test Tenant When You Only Get Ten Users
A fresh Okta trial org is empty. The license caps you at ten active users, so I built a lab where 8 awkward users plus everything Okta doesn’t cap does the work. Seeds in 2 min, tears down safely.
Understanding Orphaned SIDs in Active Directory
Deleting an AD account does not remove the security references pointing at it; they sit in ACLs as orphaned SIDs. An over-engineered PowerShell solution to find them at scale, with batching, logging and full test coverage.