Single Sign-On is one of those topics that looks simple on paper but hides a surprising amount of complexity once you're dealing with real production systems.
In this post I walk through the full architecture I built for IZEOS ONE — a healthcare platform connecting thousands of medical professionals across Italy. The stack involves Keycloak as the identity provider, custom Java SPI authenticators for business-specific registration logic, and a React/TypeScript frontend handling multi-step onboarding flows.
The hardest part? CORS. Always CORS.