1 min lesson
The identity half: debug, don't define
Put this idea into your own words: "Have crisp answers for the common breakages across the three protocols you'll live in."
Step 1 of 3
The identity half: debug, don't define
They won't ask "what is SAMLSecurity Assertion Markup Language. The XML-era enterprise standard that powers single sign-on: your identity provider vouches for you to each app. Older than OIDC but still what many enterprise tools speak. Press Enter for the full definition.." They'll ask how you'd debug a specific failure. Have crisp answers for the common breakages across the three protocols you'll live in.
Learn more
Advanced table
Reference table
- Symptom
- SAMLSecurity Assertion Markup Language. The XML-era enterprise standard that powers single sign-on: your identity provider vouches for you to each app. Older than OIDC but still what many enterprise tools speak. Press Enter for the full definition. login loops or 403s after IdP redirect
- Likely cause
- Clock skew, audience/ACS URL mismatch or unsigned assertion
- Where you'd look
- Decode the SAMLResponse, check Audience, Recipient, NotOnOrAfter and signature
- Symptom
- OIDCOpenID Connect. The modern single sign-on standard, built as an identity layer on top of OAuth 2.0. Where SAML is XML and enterprise-legacy, OIDC is JSON and what newer tools implement first. Press Enter for the full definition. token rejected by the app
- Likely cause
- Wrong aud claim, expired token or wrong signing key
- Where you'd look
- Inspect the JWT claims, validate against the JWKS endpoint, check iss/aud/exp
- Symptom
- SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. user created but with no groups
- Likely cause
- Group push not enabled or attribute mapping gap
- Where you'd look
- Check IdP-side SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. mappings and whether groups are in scope for push
- Symptom
- Deprovisioned in IdP but still active downstream
- Likely cause
- App doesn't honor SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. deactivate or soft-delete only
- Where you'd look
- Verify the SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. PATCH active:false path and the app's offboarding behavior
| Symptom | Likely cause | Where you'd look |
|---|---|---|
| SAMLSecurity Assertion Markup Language. The XML-era enterprise standard that powers single sign-on: your identity provider vouches for you to each app. Older than OIDC but still what many enterprise tools speak. Press Enter for the full definition. login loops or 403s after IdP redirect | Clock skew, audience/ACS URL mismatch or unsigned assertion | Decode the SAMLResponse, check Audience, Recipient, NotOnOrAfter and signature |
| OIDCOpenID Connect. The modern single sign-on standard, built as an identity layer on top of OAuth 2.0. Where SAML is XML and enterprise-legacy, OIDC is JSON and what newer tools implement first. Press Enter for the full definition. token rejected by the app | Wrong aud claim, expired token or wrong signing key | Inspect the JWT claims, validate against the JWKS endpoint, check iss/aud/exp |
| SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. user created but with no groups | Group push not enabled or attribute mapping gap | Check IdP-side SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. mappings and whether groups are in scope for push |
| Deprovisioned in IdP but still active downstream | App doesn't honor SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. deactivate or soft-delete only | Verify the SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. PATCH active:false path and the app's offboarding behavior |
Senior signal: you reason from symptom to root cause and name the exact field or endpoint you'd inspect.
- Auth code + PKCE
- User-facing apps (web/native/SPA) where a human logs in interactively.
- Client credentials
- Machine-to-machine - your provisioning script calling an API with no user present.
- SAML assertion
- Enterprise SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition. into legacy/SaaS apps that speak SAMLSecurity Assertion Markup Language. The XML-era enterprise standard that powers single sign-on: your identity provider vouches for you to each app. Older than OIDC but still what many enterprise tools speak. Press Enter for the full definition., IdP-initiated or SP-initiated.
- SCIM 2.0
- Automated provisioning/deprovisioning and group sync between IdP and downstream apps.
When you hit a scripting problem, scope out loud before you type: "I'll page through all users, build a set of the desired state, diff against current state and only act on the delta - that keeps it idempotent." Saying the plan first is the senior tell and it gives the interviewer a chance to redirect before you've written fifty lines.
Cursor allows and expects AI tools in coding work, but the first technical screen may prohibit them to test raw fluency. Be able to write a clean, idempotent API script without a copilot, then show how you'd accelerate it with Cursor when allowed. Ask the recruiter which rounds permit AI so you're not surprised.
QA user was deprovisioned in Okta last week but can still log into a SaaS app. Walk through how you'd debug it.