In plain terms — no computer science degree required

One door, three bolts: why one login is safer than twenty

Technical appendix to the Sunday edition

This page belongs to the Sunday edition “One door for everything: SSO — and whether you can do without Microsoft and Google”. That text covers the why — this one covers the how: a single drawing that shows why one well-secured door can be safer than twenty — and how everything behind it can be locked in minutes in an emergency. Ten minutes, no expertise required.

The drawing

THE PERSONone single, strong loginpasskey or fingerprint —no note under the keyboardidentify once,properly checkedTHE ONE DOORcentral user directory —the reception (identity provider)Bolt 1 — lock the accountthe identity itselfBolt 2 — kill running sessionswhoever is inside gets thrown outBolt 3 — cut network accessthe line itself is severedin an emergency: each bolt alone —all three in minutes, from anywhereday pass:the door vouchesTHE ROOMS BEHIND ITPassword vaultthe safe holding every keyGit systemcode and configurationNewsletter systemconnected just this weekInternal dashboardthe admin toolsno service keeps passwords of its own —all of them trust the one doorbefore: twenty doors, twenty keys —and every departure a scavenger hunt

On the left: one login instead of twenty

On the far left stands you — with your devices and with exactlyone login. Because there is only one, it pays to make it excellent: a passkey or your fingerprint instead of a password that ends up on a note under the keyboard. That is the first reason one door can be safer than twenty: twenty separate logins never get that care — convenience always wins there.

The door in the middle is the central user directory — the Sunday edition calls it the reception desk, technically the identity provider. You identify yourself once, properly checked, and reception hands you a day pass: a cryptographic token that opens exactly the right rooms. The blue arrows in the drawing are that vouching — the door tells every room: “this really is that person, and they are allowed in here.”

In the middle: the three bolts

The heart of the drawing is the three amber bolts on the door — and the point is that each can be pulled on its own(the small red arrows). They lock three different things:

  • Bolt 1 locks the account — the identity itself. From that moment on, the person cannot sign in anywhere anymore.
  • Bolt 2 kills the running sessions. Whoever signed in this morning and is still “inside” gets thrown out — the day pass is declared invalid now, not at the next login.
  • Bolt 3 cuts network access — the line itself. Even someone who could still see the rooms no longer reaches the door.

That is the answer to the question in the title: when a person leaves — on good terms or bad — all three bolts are pulled in minutes, from anywhere. Without a central door, the same task would be a scavenger hunt through twenty systems, with nobody quite sure it is not twenty-one. That is exactly what the faded strip at the bottom of the drawing shows.

On the right: rooms without locks of their own

On the right are the services this is really about: the password vault, the git system, the newsletter tool, the internal dashboard. The decisive part is written underneath them:none of these services keeps passwords of its own.They do not check who you are themselves — they trust the day pass from the one door. Connecting a new tool therefore does not mean “new account, new password” but: create one group in the directory, bind the tool to it, done. Granting access means person into the group; revoking means person out.

And because no scattered passwords exist anywhere, there is no side entrance you could forget when locking down: whoever fails at the door gets into no room at all — no matter how many rooms there are.

Staying honest: what the one door does not solve

Three things need saying, or this drawing would be advertising rather than explanation:

  • One door is also a single point of attack.Whatever bundles also concentrates risk. That is why the door itself deserves the best protection in the house — enforce passkeys, take updates seriously, read the journal — and for the case that the reception itself jams, you need the break-glass account: the emergency admin on paper.
  • Not every tool knows the door. Older software speaks no OIDC or SAML, and whoever uses M365 with Exchange effectively keeps their identities at Microsoft — the mailbox drags the identity along. The drawing shows the target state; the way there is staged, move by move.
  • Bolts that have never been pulled jam in an emergency. “Locked in minutes” only holds if the motion has been rehearsed — on a test account, with a look at the log. An emergency plan nobody has ever walked through is a document, not a plan.

You do not have to believe this — you can walk through it

The nice thing about this architecture: it is checkable. The reception keeps a journal — who wanted through the door when, what was rejected. Pull the three bolts on a test account and look at the log: the locked account fails at the door, the killed session is gone, the severed line ends outside the building. Then ask yourself the Sunday question: how many systems would you have to touch today if someone left tomorrow? If the answer is not “one switch, all of them, five minutes”, you now know what the target picture looks like.

Why all of this matters — and whether a company can do it entirely without Microsoft, Google and social logins — is in the Sunday edition: “One door for everything: SSO — and whether you can do without Microsoft and Google”

← Back to the Sunday edition