Software 6 May 2026 3 min read One identity, every product By Old Forge Technologies 102 reads Contents When you sign in to **oldforge.tech**, you should be one click away from everything I've built. Not "create an account on each one" - actually *one* click, no second login, no second password. That's now true for two products, with a third on the way. Here's the spine that makes it work, and the move that matters more than the SSO part. ## The spine: a single Keycloak realm All Old Forge products federate against a single Keycloak realm at `id.oldforge.tech`. Each product is registered as an OIDC client in that realm; on first sign-in a session cookie pins your browser to the realm. From that point on, the trip from `/account` to a product looks like this: 1. You click a tile - say, *Mantrinol*. 2. Your browser hits `https://server.mantrinol.com/auth/login`. 3. Mantrinol redirects to Keycloak with the OIDC dance every confidential client has to do. 4. Keycloak sees the cookie you already hold, decides "yes, same human," and bounces you back to Mantrinol with an authorization code - *no login form, no prompt*. 5. Mantrinol exchanges the code for an ID token, and you're inside in under a second. The mechanic is unglamorous. The experience is the magic. ## Instant tenancy There's a second move that matters more than the SSO part: on first arrival, the product provisions your tenant on the spot. It looks at the ID token, sees a user it's never seen before, and writes a row. The next thing you see is your own empty workspace - no onboarding wizard, no "please pick a plan," no "we'll email you a confirmation." You're already a tenant of one. This is something I think B2B SaaS gets wrong almost universally. The friction between "I clicked the link" and "I'm doing useful work" is the most expensive moment in a product's funnel, and most teams answer it by *building elaborate onboarding flows*. The right answer is to delete the moment. ## Where the portfolio stands - **Fenrir** - OWASP-ZAP-based vulnerability scanner. Federated. Click the tile, you're in. - **Mantrinol** - fleet backup orchestration over NATS. Federated as of this week. Click the tile, you have a tenant. - **Wegweiser** - multi-tenant analytics for MSPs. Federation planned; soft-federation alongside its existing local + Azure AD sign-in. Each new tile that appears on `/account` is one less password the world has to remember and one less sign-up form that has to exist. ## Why I'm building this way Most one-person shops don't bother. The alternative - separate auth on each product - is faster to ship and won't bite you in the first six months. It bites in year two, when you have three products and the question *"is this the same person across them?"* becomes architectural instead of trivial. By then, retrofitting a shared identity layer is a quarter's worth of work, and you'll have built around the shape of "no shared identity" in ways you don't yet realise. The bet I'm making is that having the spine *first* - even with one product on it, even before there's a portfolio worth federating - buys me the freedom to ship the next tile in an afternoon. This week, that bet paid out.
