SAML

Like the logged in web is where agentic identity needs to be solved, but there isn't a protocol that we can bolt on top of.

There's like SSO and, and SAML and like OAuth that kind of can help here, but it seems like agents are going to try and access services on behalf of people.

And maybe, once again, this goes back to how you and I have different views here or different beliefs.

Like I might believe that I think my agent should be a delegate of me because I probably have like a limited scope of access.

Its entire existence is dedicated to verifying who you are.

And it does that using modern web protocols, right? OIBC, SAMLNL, OAuth 2.0.

But what do those actually do in plain English? Because we throw around acronyms like OAuth, but architects need to really understand the mechanism.

Think of it like a bouncer at a highly secure club.

And finally, for today.

Citrix Netscaler ADC and Gateway are facing CVE-2026-19490, a critical SAML authentication bypass scored CVSS 9.3 that can be triggered by a single unauthenticated request.

Security researchers say the impact varies by configuration, ranging from a pre-authentication crash to an internal network proxy, and in some cases, root on the appliance if management credentials are exposed.

Defenders are being urged to patch to 13.1.63.2.1 or 14.1.73.3.2 or later, or migrate off end-of-life branches and test each affected virtual server separately.

It allows for really easy onboarding and offboarding.

So you can even use single sign-on and SAML or SCIM for automated user provisioning.

you can just essentially define who in your organization has access to cloud.

I mean, it's very much like a platform, right? You're adding people to have seats and then you're managing their usage, which is also really important because it gives you the ability to monitor that variable cost, that consumption, that usage across the entire team.

To me, it says, if you're new to identity or even you're in the space, the fundamentals is the first part of it that a lot of people don't have is the fundamentals of identity.

What is the different authorization models out there? What are the different authentication models out there? What, what are, what, what is SSO? What is SAML, right? What is OIDC? To be able to understand the lingo and talk to talk is your first part of it, because then once you understand what the actual join or move reliever or onboarding transfers offboarding process is.

And to be able to explain to somebody easily, I joke about this, but I always tell my people is explain to you as if you're a two or six grader what this is, right? The better you can do that, the more that you know it in your head.

And I always tell that to my mentees or people who offer, who pay for my services to get mentored is that's the first thing I do is I have them take the fundamentals.

And if more agents can authenticate themselves in a standardized way, and the credentials that I need to issue are more standardized credentials, it means it's less work to support a bigger variety of things, okay? So I think that that's really critical.

But I think at the end of the day, this business of converting from one identity to one access credential to different ones, that one, the world's just a messy place, okay, right? And that's just my job, okay, right? And so I think we do need to recognize that even in a world of SAML, okay, for instance, for users, you still need identity systems like ENTRE or OKTO or PING, because they're the ones that manage the policies and the real work, right, of deciding what to do, determining posture and risk, right, making an access decision, issuing a credential, that is still sort of above those standards, okay? So that's how I think about standards.

Yeah, yeah, okay.

I want to add to that and I think that the standards are really an alignment in terms of a framework for us as an industry and the way that we need to look and to make decisions.