Hacker News Reader

>The metaphor that makes sense to me is that the identity provider issues passports and Cloudflare One is the border agent that checks that they're valid. At any particular moment, different passports from different providers may be allowed or forbidden to enter just by updating the instructions the border agent follows.

Can someone please elaborate on this metaphor? I don't quite get it in context.

View on HN

Happy to help. We can use our network, specifically our Access product, to check for identity. When a user requests an application, our network can stop that request and ask the user to show ID.

The difference is that we don't issue that identity. We aren't an identity provider, like Okta or Azure AD. Instead, teams integrate our Access product with their identity provider which tells us which sources of identity to trust (in the same way a bouncer or border guard doesn't create your identity card for you, but they know what a valid one looks like).

Reply on news.ycombinator.com