IAM engineering · production notes

Field guides for engineers who run identity in production.

Troubleshooting guides, working configurations and browser-based tools for Keycloak, ForgeRock, Ping Identity, SailPoint, OAuth 2.0 and SAML. Written by a practicing IAM architect and checked against vendor documentation.

Browse the guides Open the toolbox

iamdevbox.jwt HS256

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL3d3dy5pYW1kZXZib3guY29tIiwic3ViIjoiaWFtLWVuZ2luZWVyIiwiYXVkIjpbImtleWNsb2FrIiwiZm9yZ2Vyb2NrIiwic2FpbHBvaW50Iiwib2F1dGgyIiwic2FtbCJdLCJndWlkZXMiOjMxNywidG9vbHMiOjE1LCJyZXBvcyI6MjgsInZpZGVvcyI6NzcsImlhdCI6MTc4OTQwMjY5NX0.glQonsN3F2Xvom8gCsiCl8sYikGCImX8pln1oV2MiqQ

{
  "iss": "https://www.iamdevbox.com",
  "sub": "iam-engineer",
  "aud": ["keycloak","forgerock","sailpoint","oauth2","saml"],
  "guides": 317,   // long-form articles
  "tools": 15,    // run entirely in your browser
  "repos": 28,    // companion code on GitHub
  "videos": 77,   // on YouTube
  "iat": 1789402695  // built 14 Sep 2026
}

Signed with the secret iamdevbox. Verify it in the JWT Decoder

Covers

Keycloak
ForgeRock AM · IDM · DS
PingOne Advanced Identity Cloud
SailPoint IdentityIQ
Okta
Auth0
Microsoft Entra ID
Ory · Zitadel · Authentik

Topic hubs

Start from the platform you're working on.

Each hub is a long-form guide that links to every related article, from first install to production troubleshooting.

All 317 guides

28 guides

Keycloak

Install, federate with LDAP, run it in Docker, tune sessions, and fix the errors that show up at 2 a.m.

Open the hub 76 guides

OAuth 2.0 & OpenID Connect

Grant types, PKCE, token lifetimes, refresh rotation, and the failure modes of each flow.

Open the hub 26 guides

SAML & single sign-on

Assertions, metadata, signature validation, and debugging responses the IdP swears are fine.

Open the hub 108 guides

ForgeRock & Ping Identity

AM, IDM, DS and IG in production. Journeys, scripted connectors, replication and certificates.

Open the hub New series

SailPoint IdentityIQ

BeanShell rules, workflows, aggregation, and the spt_ tables you end up querying anyway.

Open the hub 25 guides

Platform comparisons

Keycloak vs Auth0 vs Okta, open-source IAM shortlists, and what migrating between them costs.

Open the hub

Error index

Search by the error you're seeing.

Each guide starts with the log line, works through the causes, and ends with the fix and how to confirm it.

Toolbox

Tools that never see your tokens.

Every tool runs inside the browser tab. Paste a production JWT or SAML response; nothing is sent to a server.

All 15 tools

/tools/jwt-decode/

JWT Decoder

Decode header and claims, check expiry and algorithm, spot the wrong audience.

Open tool /tools/pkce-generator/

PKCE Generator

Generate code_verifier and S256 code_challenge pairs for authorization-code flows.

Open tool /tools/saml-decoder/

SAML Decoder

Inflate and pretty-print SAML requests and responses. Read NameID, attributes and conditions.

Open tool /tools/oauth-playground/

OAuth 2.0 Playground

Run authorization-code, PKCE and client-credentials flows against your own provider.

Open tool /tools/oidc-checker/

OIDC Discovery Checker

Fetch .well-known/openid-configuration and validate endpoints, scopes and signing keys.

Open tool /tools/forgerock-url-builder/

ForgeRock URL Builder

Build AM OAuth 2.0, journey, IDM and SAML endpoint URLs without memorising the syntax.

Open tool

Latest

Recently published.

Browse all guides

Sep 3, 2026 · 10 min read

Simplify Your Stack (and Save!): A Guide to Linking Your Auth0 Tenants

Who writes this

Written by a practicing IAM architect.

IAMDevBox is written by an enterprise identity architect with more than fifteen years of production IAM work and certifications across ForgeRock, Ping Identity and SailPoint. The guides come from real incidents, migrations and integrations, and every command, table name and configuration path is checked against vendor documentation before it is published.

Drafting is AI-assisted. Review, testing and the judgment calls are human. If a guide is wrong, say so and it gets fixed.

About IAMDevBox · IAM consulting · ForgeRock deployment checklist