It is easy to read a specification and conclude the problem is solved. It is harder to sit with the twenty implementations that each read the same paragraph differently and still call themselves compliant.
This piece walks through how we think about it at Paycux, what we have changed our minds about, and where the sharp edges are.
What are Paycux Pipes
Consider what are paycux pipes. Normalization is the whole job. Two providers can be perfectly compliant and still disagree about what a group membership is, whether a logout is meaningful, and which attribute carries the email address.
Normalization is the whole job. Two providers can be perfectly compliant and still disagree about what a group membership is, whether a logout is meaningful, and which attribute carries the email address.
Step 1: Configure Google
That brings us to step 1: configure google. Normalization is the whole job. Two providers can be perfectly compliant and still disagree about what a group membership is, whether a logout is meaningful, and which attribute carries the email address.
Version the assumption, not just the code. Write down what you expect from the peer, and make the failure loud when it stops being true, because the alternative is a connection that half works for six weeks.
- Validate signature, issuer, audience and expiry as four separate checks
- Normalize provider attributes into one internal shape
- Fail loudly when a peer stops meeting a documented assumption
- Keep a fixture per provider so regressions surface in CI
Step 2: Add the Pipes Widget
Step 2: Add the Pipes Widget is where this gets concrete. Treat anything the other side sends as untrusted input until it has been through validation you wrote. Signature checks, issuer checks, audience checks and expiry checks are four separate decisions, and skipping any one of them is a real vulnerability rather than a theoretical one.
Treat anything the other side sends as untrusted input until it has been through validation you wrote. Signature checks, issuer checks, audience checks and expiry checks are four separate decisions, and skipping any one of them is a real vulnerability rather than a theoretical one.
2a. Install dependencies
Consider 2a. install dependencies. Normalization is the whole job. Two providers can be perfectly compliant and still disagree about what a group membership is, whether a logout is meaningful, and which attribute carries the email address.
Treat anything the other side sends as untrusted input until it has been through validation you wrote. Signature checks, issuer checks, audience checks and expiry checks are four separate decisions, and skipping any one of them is a real vulnerability rather than a theoretical one.
Normalization is the whole job.
2b. Configure Paycux API key and CORS
2b. Configure Paycux API key and CORS is where this gets concrete. Version the assumption, not just the code. Write down what you expect from the peer, and make the failure loud when it stops being true, because the alternative is a connection that half works for six weeks.
Treat anything the other side sends as untrusted input until it has been through validation you wrote. Signature checks, issuer checks, audience checks and expiry checks are four separate decisions, and skipping any one of them is a real vulnerability rather than a theoretical one.
2c. Get authorization token
That brings us to 2c. get authorization token. Version the assumption, not just the code. Write down what you expect from the peer, and make the failure loud when it stops being true, because the alternative is a connection that half works for six weeks.
Normalization is the whole job. Two providers can be perfectly compliant and still disagree about what a group membership is, whether a logout is meaningful, and which attribute carries the email address.
Step 3: Get an access token and call Google Calendar
That brings us to step 3: get an access token and call google calendar. Version the assumption, not just the code. Write down what you expect from the peer, and make the failure loud when it stops being true, because the alternative is a connection that half works for six weeks.
Treat anything the other side sends as untrusted input until it has been through validation you wrote. Signature checks, issuer checks, audience checks and expiry checks are four separate decisions, and skipping any one of them is a real vulnerability rather than a theoretical one.
Where this leaves us
If there is one thing worth taking away, it is that the expensive decisions are the ones made implicitly. Making them on purpose costs an afternoon.
If you are working through the same problem and want to compare notes, the docs cover the mechanics and the console shows the behaviour on your own data.
Everything here, already built
Sign-in, enterprise SSO, directory provisioning, roles and an audit trail behind one API. Start with the quickstart and have a working sign-in this afternoon.