SSO and service catalog for contractors
My scope combined technical consulting and development of the first custom contractor account on Symfony/Vue.js: SSO path, service catalog, contractor onboarding flow, and integration with the existing identity setup.
- Role
- Developer and technical consultant
- Context
- Employee and contractor access to services
- Timeline
- 2 months for SSO MVP; 3 weeks for catalog
- Stack
- Keycloak, Active Directory, PHP/Symfony, Vue.js
Business task
Employees and contractors had a fragmented path to services: separate links, passwords, instructions, and manual access steps. Support time was spent on navigation and passwords instead of the actual services.
MVP boundary
The first release did not try to cover every access scenario. It needed one entry point, integration with the existing identity infrastructure, and an extensible contractor path that could grow after the first services were connected.
Architecture choice
Keycloak was used as the Identity Provider, while Active Directory remained the identity source for the first stage. This avoided a custom authorization layer and kept the existing user base intact.
Service catalog
The catalog solved a practical user problem: where to find the right service, which access rules apply, and what to do next. It was released in 3 weeks while the SSO work was being finalized.
Contractor account
A boxed platform was too heavy for the first scope. The contractor account was built with PHP/Symfony and Vue.js to validate the real onboarding scenario faster and avoid unnecessary platform overhead.
Launch
In 2 months, the team set up the development infrastructure, agreed the SSO structure, configured Keycloak, connected Active Directory identification, and enabled SSO for the first corporate service.
Operational effect
After launch, the contractor path became easier to explain, link and password questions had one entry point, and the service catalog removed part of the navigation burden for employees and support.