Apidays Virtual Helsinki - Andy March, OKTA
summary
Argues that using open standards like OAuth/OpenID and treating identity as code prevents costly mistakes; demonstrates creating auth config, groups and Terraform-managed users so environments and test accounts are reproducible. Gives a real failure: a script that generates a few hundred or thousands of test users accidentally duplicates IDs so one test account gains every role and breaks access controls — tests still pass until real users reveal it. Recommends mocking auth boundaries, keeping user state as code, and cleaning test artifacts.
AI-written summary · about
chapters (9)
- 0:00Intro
- 1:48About Andy
- 2:10Information wants to be free
- 2:50Information wants to be expensive
- 5:55Better tests
- 7:37User identity
- 8:49Unit tests
- 10:53Dependencies
- 16:48Summary
related talks
54mWho's your user? OpenID from the ground-up
50mTraffic safety: Auditing and enforcing IAM best practices
29mAuthz as a dev workflow
51mDefensive Coding Bootcamp
43mPasswordless: a story of risk, protection and excellent UX
24mBuilding an Accessible API Spec with Traditional Engineering Teams
19mDiscovering the Untold User Stories of Kubernetes With Applied Anthropology
27mAPI Productivity by Design