IDHub — Development Story | AMELA Case Study

01

CLIENT

About the client

One of the country's leading SaaS development companies, "OpenLab Inc."

A SaaS development company built on three pillars — contract development, in-house products, and consulting. Its ~500 employees use more than 10 business SaaS apps daily (accounting, HR, recruiting, attendance, expense, project management, and more), and because each system issued its own separate ID, the setup posed challenges in both operational efficiency and security.

Driven by a high mid-career hiring ratio, the frequency of ID revocation on departures, the parallel operation of Microsoft 365 and Google Workspace, and tighter audit requirements, building an SSO platform to consolidate internal IDs in one place emerged as a management priority.

Headcount

500+

Engineering + Corporate

Integrated systems

10+

Accounting, HR, Recruiting & more

Monthly on/offboarding

20+

ID provisioning scope

BUSINESS FLOW

The 4 steps of the SSO auth flow

STEP 01

Employee login

Access IDHub via Microsoft 365 / Google

STEP 02

IdP authentication

Validate external IdP tokens and fetch profiles

STEP 03

JWT issuance

Issue short-lived JWTs, manage revocation with Redis

STEP 04

Business-system usage

Use 10 systems with the same token

02

CHALLENGE

Design challenges to solve

Four design challenges threatening operations and security.

We saw this not as a technical problem but as a management challenge tied directly to data-leak risk, offboarding, IdP-switching cost, and token-revocation delay, and we needed to design, from scratch, a mechanism to consolidate internal IDs in one place.

Design challenge ①

How to curb data-leak risk from password reuse

With 10 systems × separate IDs, employees reusing 3–4 passwords on average became the norm, carrying the risk that a breach of one system would spread company-wide.

Design challenge ②

How to build a mechanism that brings missed account deletions on departure to zero

1–2 missed offboardings per month on average occurred, leaving departed employees' permissions active — a management issue from an audit and compliance standpoint.

Design challenge ③

How to eliminate per-system rework when switching IdPs

For a future Microsoft 365 → Google Workspace migration or adding SAML support, 10 systems × per-system rework — a state we could not overlook as technical debt.

Design challenge ④

How to achieve instant token revocation when unauthorized access is detected

In a design that keeps JWTs long-lived,Up to a 24-hour lag before revocation takes effect occurred — a structural risk that significantly delayed the initial response to incidents.

03

ARCHITECTURE

The architecture we built together

Building in-house from scratch, uniting four domains into one SSO platform.

With a deep understanding of OpenLab's organization and operations, "Operational efficiency for IT, a better experience for employees, security standardization for management" — we built an API-based SSO gateway uniting these three-sided needs into a single platform, entirely in-house from scratch.

EXECUTION

4

Duration (months)

12

Total effort (person-months)

Domain ①

IdP integration

Challenges

Each of the 10 systems implemented its own MS / Google integration — double maintenance.

Solution

Plugin-style IdP abstraction layer

MS Graph + Google Socialite consolidated into a single SSO API.

Domain ②

Token management

Challenges

Long-lived JWTs = up to 24h of lag before revocation takes effect.

Solution

Short-lived JWT + Redis blacklist

Revocation reflected across all systems in 80ms (Redis TTL sync).

Domain ③

Profile

Challenges

Department, title, and avatar were managed separately in each system — inconsistent.

Solution

MongoDB profile aggregation + S3 avatars

Avatars auto-synced from the IdP and displayed uniformly across all systems.

Domain ④

On/offboarding ops

Challenges

Manual operations on joining/leaving took 10 systems × several days.

Solution

Company-wide operations on one screen

Invitations, permission changes, and offboarding apply to all systems instantly.

TECH STACK

Backend

Laravel 7

PHP 8

JWT ⚡ Socialite

Data

MongoDB

Redis

MySQL

Infra & IdP

AWS S3

Docker M MS Graph G Google OAuth2

04

IMPACT

The value the platform creates

OpenLab's internal IT operations move to the next stage.

After adopting IDHub, the reliability of auth operations and security standardization improved greatly versus the separate-ID era.

OUTCOME ①

Gains in internal IT operational efficiency

10 systems × separate IDs consolidated into one ID. Onboarding/offboarding rework was eliminated, and the IT department's month-end overtime dropped sharply.

OUTCOME ②

Establishing security standardization

Password reuse eliminated company-wide; offboarding now takes effect instantly. Audit and compliance handling standardized.

OUTCOME ③

Resolving technical debt

Per-system rework when switching IdPs is no longer needed. Gained the scalability to add new business systems with just an SSO connection.

OUTCOME ④

Improved employee experience

Every employee can access all business systems with a single ID. Forgotten-password inquiries plummeted.

STAKEHOLDER

IT administrator

On/offboarding & operations

Typically

On/offboarding meant per-system operations across 10 systems, with 1–2 missed deletions per month on average.

With IDHub,

All company-wide operations completed on one screen; achieved zero missed deletions.

Business impact

On/offboarding ops 10 → 1 screen

Eliminated the IT team's month-end overtime

STAKEHOLDER

General staff

~500 people

Typically

Separate logins for 10 systems; password reuse was the norm.

With IDHub,

All systems with one ID; forgotten-password inquiries plummeted.

Business impact

Dramatic improvement in employee experience

IT inquiries -80%

STAKEHOLDER

Security officer

Audit & compliance

Typically

Up to 24h until revocation on fraud detection, with logs scattered across each SaaS.

With IDHub,

Token revocation in 80ms; auth logs aggregated in a unified audit view.

Business impact

Revocation latency 24h → 80ms

Greatly reduced audit-response effort

STAKEHOLDER

Management

CTO · IT lead

Typically

Auth integration was custom-built each time a new business SaaS was added.

With IDHub,

A new SaaS is fully onboarded just by connecting it to IDHub.

Business impact

Secured scalability of IT investment

Adding new business SaaS accelerated

05

DEMO

Three scenarios

Experience unified SSO with a live, working demo.

FLAGSHIP

SCENARIO 01 · Employee

SSO portal

·The 10 integrated business systems shown as tiles
·Category filter (Accounting / HR / Recruiting)
·One-click transition (new SSO session)
·Active-session list and instant revocation

Launch demo

SCENARIO 02 · IT administrator

User management

·Manage 500 employee IDs on one screen
·Filter by IdP, permission, and status
·New invite + offboarding (instant revocation)
·Audit response via CSV export

Launch demo

SCENARIO 03 · Security officer

Auth audit log

·Aggregate auth events from all systems
·Anomaly detection (late-night login · off-site IP)
·Instant token-revocation button
·Audit CSV export

Launch demo