Authentication is their problem. Authorization is yours: Federating permissions across multiple IdPs

Federated authorization addresses the challenge of enforcing fine-grained access controls when organizations use incompatible identity providers, such as Keycloak and GitHub OAuth, without requiring disruptive identity migrations. The proposed approach uses SpiceDB to map each external account, identified by immutable provider-specific IDs such as OIDC subject claims or GitHub numeric IDs, to an organization-controlled internal user identity, while documents and permissions reference only that unified internal model. A relationship-based schema defines document ownership, editing, viewing, and sharing permissions, which SpiceDB evaluates through APIs for individual and bulk permission checks, accessible-resource lookups, relationship writes, and grant revocations. The design recommends avoiding email addresses as identifiers, treating accounts from different providers as distinct unless explicitly bound, using read-your-writes consistency tokens where needed, and reserving raw relationship reads for displaying specific grants rather than making access decisions. In production, persistent datastores and managed services such as AuthZed Cloud can provide scalable deployment, audit logging, least-privilege service access, and operational management while retaining the same authorization model.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.