Work · Case study
The console that administers your identity estate should be the most legible screen in it.
01 / Challenge
An open-source identity and access management platform had a legacy admin console with inconsistent configuration workflows and little visibility into authentication logs. For a security product that is not a cosmetic problem: an administrator who cannot see what authenticated, or who configures a server two different ways on two screens, is a compliance exposure. Separately, FIDO2 enrolment was returning 400 errors that varied by environment.
02 / Approach
The console was migrated to TypeScript structurally rather than file by file. Types were introduced where the configuration workflows cross the Config API, because that is where a wrong shape becomes a wrong server setting, and the reusable component layer was rebuilt so the same control renders the same way wherever a setting appears.
Authentication log visibility was treated as a first-class screen rather than a debugging afterthought. Configuration handling was standardised across the surfaces that touch the auth server, SCIM, FIDO2, Agama, Casa and the rest, so an administrator reads one grammar across the estate.
The FIDO2 failures turned out to be a mismatch between what the backend expected and what a real browser actually sends. Rather than reason about the specification, we captured genuine browser WebAuthn registration responses and aligned the verification payloads and rp.id checks to them, then built integration and controller tests from real server configurations so the same drift could not return silently.
03 / Outcome
months of continuous delivery
deployment targets, K8s and VM
The console is measurably more maintainable — TypeScript caught a class of error that previously reached a running server, builds are faster, and form-level validation is consistent across configuration screens. FIDO2 enrolment and authentication are stable across environments, with test coverage on the register and verify endpoints that mirrors real server behaviour rather than a mocked ideal.