Recent content on Andrew Doering
Nine days ago I published a post explaining why Tailscale couldn’t route on the reMarkable Paper Pro . The kernel ships without CONFIG_TUN , so tailscaled ran in userspace networking mode, which authenticates and handshakes fine while giving the OS nothing to route packets through. That post ended with a prediction that if vellum’s community module landed, the whole question would…
I wanted Tailscale running on my reMarkable Paper Pro so I could reach SSH and a couple of internal services while traveling, without carrying a laptop just to jump through a bastion host. The tablet is already in devmode, it’s Linux under the hood, and Tailscale ships an ARM64 binary. On paper this should have been a ten-minute job. 
 The symptom 
 tailscale status looked correct.…
Every morning at six, a container on my home server builds a fresh notebook and pushes it to my reMarkable, the same routine from rewriting the daily journal generator to stop generating PDFs and ship native, device-templated notebooks instead. That part hasn’t changed since. Pages still just reference a built-in template by name, and the tablet draws the background itself. What I wanted to…
I’ve administered Okta for ten years now, and it’s been an enormously wild ride. I’ve done it in a highly regulated environment, at a scale-up, at a growth-stage company, and in a federal environment. Every one of those had a different answer to a question that sounds simple and isn’t: where does the data driving provisioning actually come from? 
 That question matters…
Azure Virtual Desktop can sign users in to their session host with a Microsoft Entra ID token instead of a Windows password. This is the short version: the exact steps to turn it on. 
 Every step below links to the matching section of Microsoft’s reference, Configure single sign-on for Azure Virtual Desktop - those sections include the portal screenshots. If you want the why , plus the…
Back in early 2024 I wrote about getting Device Trust working on our Azure Virtual Desktop estate . The gist of that post: because no user is assigned to a pooled VDI host, you can’t deploy a user-scoped certificate, and non-admin users can’t read the device-scoped private key, so Okta FastPass quietly breaks. We solved it by hand-editing private-key ACLs with a PowerShell script. It…
If you have ever managed a fleet of Macs, you have seen this prompt: 
 
 An update is ready to install. Slack is trying to add a new helper tool. 
Enter your password to allow this. 
 
 Slack, Spotify, VS Code, Windsurf, Claude, Cyberduck, and basically half the Electron apps on the machine all do it, and they keep doing it on every single update. End users either click Cancel…
A few months ago I wrote about Okta’s Device-Bound SSO , which welds an Okta session to a hardware key in the Secure Enclave or TPM so a stolen cookie is useless on any other machine. It is a good feature. It is also a vendor-specific one, gated behind a separate SKU and sitting on top of a full Platform SSO deployment. I ended that post wishing this kind of session security shipped as a…

 
 
 
 
 

 Tip TL;DR: if you just want the tool, it’s open source - remarkable-ocr-handwriting : a small containerized daemon that watches a folder, transcribes new reMarkable exports with a local vision LLM (via Ollama), and writes searchable Markdown into your Obsidian vault, local end to end. The rest of this post is the why , and the settings that took the…
Every morning at six, before I’m awake, a small container on my home server builds a fresh notebook and pushes it to my reMarkable. By the time I pick the tablet up there’s a dated journal page waiting, lined and ready to write on. That part hasn’t changed in a year. Almost everything underneath it has. 
 The container is remarkable-daily-journal , and for its entire 1.x life…
Det finns en basist jag följer på YouTube, en italienare som kallar sig Davie504. En kväll pratade han om sitt eget land, om hur mycket han hade lagt ner på det och hur lite han verkade få tillbaka, och det som fastnade hos mig var tanken att det blir utmattande att fortsätta älska en plats som inte älskar dig. Jag är inte italienare. Jag är amerikan, och jag har bott i Stockholm sedan våren 2021.…
There’s a bass player I follow on YouTube, an Italian guy who goes by Davie504. One night he was talking about his own country, about how much he’d put into it and how little it seemed to give back, and the thing that stayed with me was the idea that it gets exhausting to keep loving a place that doesn’t love you. I’m not Italian. I’m American, and I’ve been…
I went to read an article about human.json and got served H.P. Lovecraft instead. 
 A friend pointed me at a skeptical post about the protocol on spacepanda.se. I pulled the page up through a script rather than a browser, and what came back was a few paragraphs of markov-mangled nonsense, a garbled imitation of At the Mountains of Madness, finished off with a footer claiming “Copyright ©…
This is Part 6 of a 6-part series on AuthZEN and the Shared Signals Framework.
 Part 1: Fundamentals covers what problem this stack solves, when native roles are sufficient, and the core architecture.
 Part 2: Okta covers Okta’s SSF transmitter and receiver, ITP integration, and Workflows as the bridge to non-SSF systems.
 Part 3: Microsoft covers Entra as a CAEP transmitter,…
This is Part 5 of a 6-part series on AuthZEN and the Shared Signals Framework.
 Part 1: Fundamentals covers what problem this stack solves, when native roles are sufficient, and the core architecture.
 Part 2: Okta covers Okta’s SSF transmitter and receiver, ITP integration, and Workflows as the bridge to non-SSF systems.
 Part 3: Microsoft covers Entra as a CAEP transmitter,…
This is Part 4 of a 6-part series on AuthZEN and the Shared Signals Framework.
 Part 1: Fundamentals covers what problem this stack solves, when native roles are sufficient, and the core architecture.
 Part 2: Okta covers Okta’s SSF transmitter and receiver, ITP integration, and Workflows as the bridge to non-SSF systems.
 Part 3: Microsoft covers Entra as a CAEP transmitter,…
This is Part 3 of a 6-part series on AuthZEN and the Shared Signals Framework.
 Part 1: Fundamentals covers what problem this stack solves, when native roles are sufficient, and the core architecture.
 Part 2: Okta covers Okta’s SSF transmitter and receiver, ITP integration, and Workflows as the bridge to non-SSF systems.
Part 3: Microsoft covers Entra as a CAEP transmitter, CAE,…
This is Part 2 of a 6-part series on AuthZEN and the Shared Signals Framework.
 Part 1: Fundamentals covers what problem this stack solves, when native roles are sufficient, and the core architecture.
Part 2: Okta covers Okta’s SSF transmitter and receiver, ITP integration, and Workflows as the bridge to non-SSF systems.
 Part 3: Microsoft covers Entra as a CAEP transmitter, CAE,…
This is Part 1 of a 6-part series on AuthZEN and the Shared Signals Framework.
Part 1: Fundamentals covers what problem this stack solves and when native roles are sufficient, along with the core architecture.
 Part 2: Okta covers Okta’s SSF transmitter and receiver, ITP integration, and Workflows as the bridge to non-SSF systems.
 Part 3: Microsoft covers Entra as a CAEP…
The Problem: Your Session Cookie Is a House Key Under the Doormat 
 If you manage an Okta tenant today, here’s the uncomfortable truth about what happens after your users jump through all those authentication hoops. They punch in their password. They approve the push notification. They tap the FIDO2 key. Maybe they pass a biometric check for good measure. And at the end of that whole…
I recently completed a migration of our Microsoft 365 SSO federation from Google Workspace to Okta for our organization (~350 users). Performing this migration at 1 AM was, unfortunately, our only option. It wasn’t a great idea, but that was the timeframe I was given. If you’ve read my earlier post on transitioning to Okta from Active Directory , this is a continuation (though very…
There’s a category of security tooling that promises to protect your organization from insider threats by analyzing employee behavior. User Behavior Analytics (UBA) and User and Entity Behavior Analytics (UEBA) tools build profiles of how each person works - what they access, when, how often, from where - and flag deviations as potential threats. The pitch is compelling: catch the rogue…
This is Part 4 of a 4-part series on identity as the new security perimeter. Part 1: The Identity Tax covers the SSO Tax, the visibility gap, and translating protocols into business language. Part 2: Identity in Practice covers identity drift, lifecycle management, and the ROI math. Part 3: The Future of Identity explores non-human identity, continuous authentication, and the standards reshaping…
This is Part 3 of a 4-part series on identity as the new security perimeter. Part 1: The Identity Tax covers the SSO Tax, the visibility gap, and translating protocols into business language. Part 2: Identity in Practice covers identity drift, lifecycle management, and the ROI math. Part 4: Identity at the Edge covers data-centric security, physical/digital convergence, and contextual trust. 
…
This is Part 2 of a 4-part series on identity as the new security perimeter. Part 1: The Identity Tax covers the SSO Tax, the visibility gap, and translating protocols into business language. Part 3: The Future of Identity explores non-human identity, continuous authentication, and the standards reshaping the perimeter. Part 4: Identity at the Edge covers data-centric security, physical/digital…
This is Part 1 of a 4-part series on identity as the new security perimeter. Part 2: Identity in Practice covers identity drift, lifecycle management, and the ROI math. Part 3: The Future of Identity explores non-human identity, continuous authentication, and the standards reshaping the perimeter. Part 4: Identity at the Edge covers data-centric security, physical/digital convergence, and…
The printer is dying. There is no bang, just a deprecation notice. And it’s taking fax down with it. 
 In January 2026, Microsoft stopped distributing legacy V3 and V4 printer drivers through Windows Update for Windows 11 and Windows Server 2025. By July 2026, Windows will automatically prefer its built-in IPP Class Driver over any third-party alternative. By July 2027, third-party…

 
 
 
 
 

 Note Update (June 2026): This post solves the input problem - reshaping tall reMarkable exports so Vision LLMs can read them. I’ve since taken it a step further: a fully local OCR pipeline that transcribes the handwriting straight to searchable Markdown automatically, and folds this splitting step in. See the follow-up, Making my reMarkable…
Introduction 
 I received a reMarkable tablet for note-taking and document annotation over the holidays. I had been eyeing one for a while now. After a few weeks of using it, it is a fantastic device for distraction-free writing and reading, but getting those handwritten notes into my knowledge management system (Obsidian) has been a bit of a friction point - even prior to owning it. 
…
I have family members retiring soon, and apart from getting their laptops set up so that they have a low-maintenance life, there is an elephant in the room we don’t talk about. At least one of my family members has been using their work accounts for the past 30+ years of their life as their personal email, calendar, contacts, drive, etc. 
 Obviously that is a no-no. 
 So how do we…
After a routine reboot, my entire self-hosted infrastructure went dark. Services that had been running flawlessly for months suddenly returned 504 Gateway Timeout errors. What followed was a multi-hour debugging session that uncovered a subtle but devastating conflict between Docker’s dynamic firewall management and a well-intentioned but misguided attempt to persist iptables rules. 
…
When you can’t install Tailscale on a device - like a work laptop with MDM restrictions - but still need secure access to your homelab services, what are your options? This post explores setting up Cloudflare WARP Connector as an alternative to Tailscale for accessing internal Docker services, and compares the two approaches. 
 WARP Connector is a relatively new feature that Cloudflare…
Solving the Okta Group Rename Headache: A Script to Export Push Mappings 
 Hey there, fellow identity admins! 
 If you’ve been working with Okta and Microsoft Entra ID (formerly Azure AD) integration, I bet you’ve run into this frustrating scenario: You rename a group in Okta, expecting everything to sync smoothly to Entra, but instead… crickets . The group push just…
Home Assistant Automation Watchdog: Because Someone Always Clicks the Wrong Thing 
 Introduction 
 After running Home Assistant for several years now, I’ve learned that building reliable home automation isn’t just about writing good automations - it’s about making sure they stay enabled when they’re supposed to be - it is all too easy, convenient to disable. Go in…
Introduction 
 I have been using Sonos’ Alarms feature for some time to setup alarms for certain things, like waking up, but one thing always bothered me. I could never randomize the playlist through the Sonos app, it had to be a specific playlist, the entire time, all the time. 
 So, I wanted to try to fix that using Home Assistant. 
 Getting the Spotify Playlists 
 So first…
Introduction 
 As we attempt to build out a more developer and technical driven operational workflows, this means that we need to have potentially non-technical support members, to be able to help and assist with those flows. 
 The key things we want to build out here are: 
 
 Ease of Use 
 Clear communication on what is being done 
 Serves as a training / explanation…

 
 
 
 
 

 Note
Introduction 
 At $currentJob, we wanted to allow our end-users of Okta, who are administrators in their respective platforms, to view or manage applications they are responsible for. An easy example is our Salesforce Team. We want them to manage everything related to Salesforce. But how can we do that in a way that requires limited or low administration overhead? 
 
 Introduction…
Introduction 
 As part 6 has yet to be released pending approval from my work, here is a brief overview of part 5. 
 
 
 Overview : Addressing Okta’s 100 network zone limit through automation with Terraform. 
 Network Zones Challenges : Managing SaaS services and office networks plus proxies efficiently under zone limits. 
 Cloud Services : Automating IP address…
Introduction 
 Last week we took on: 
 
 
 Overview : Addressing Okta’s 100 network zone limit through automation with Terraform. 
 Network Zones Challenges : Managing SaaS services and office networks plus proxies efficiently under zone limits. 
 Cloud Services : Automating IP address handling for API key restrictions using dynamic data sources. 
 Office Network…
Why we need Privileges or why Apple needs to get better at admin-less actions 
 Back in 2019-2020, I blogged about using Privileges as it was somewhat freshly out in the Apple Community. It worked well for certain things but had some issues, namely: 
 
 End-users couldn’t be prompted for the reason for the escalation. 
 Admin demotion on launch didn’t always work…
Introduction 
 Last week we discussed the following: 
 
 
 Introduction : Exploring Terraform’s integration for Okta to manage infrastructure and groups. 
 Group Memberships : Automating group structures to streamline chaos in organizational setups. 
 Core Groups : Managing key groups via Terraform and automating their rules effectively. 
 Office Groups :…
Introduction 
 Last week we went over the following: 
 
 
 Overview : Automating group memberships and business line structures using Terraform. 
 Group Memberships : Consolidate user data from Okta queries for efficient processing. 
 Business Line Groups : Manage 200+ dynamic business line structures via Terraform. 
 Key Requirements : Immutable IDs and change control,…
Introduction 
 Last week we discussed what went into Terraform and Github Pipelines, and Okta workspaces. A brief summary is below. 
 
 Key Points 
 Workspace Segmentation 
 
 Dividing infrastructure into distinct workspaces to scale and prevent configuration drift. 
 Core Stack: Critical components like automation scripts, groups, applications, policies, and core…
Introduction 
 Just a brief recap from last week’s blog post, we covered: 
 
 
 
 Introduction to Terraform : 
 
 
 I began using Terraform for AWS in 2017 and expanded to IT services like Okta after its Terraform provider was released in 2019. 
 
 
 Challenges with Legacy Terraform : 
 
 Inflexible, complex code designed for specific…
Switching the commenting system 
 I have been using Disqus for some time since switching my blog, as it was the most common system at the time and felt like the most frequently used. However, I have noticed I don’t get a lot of engagement. None, to be precise. That could have been due to me promoting communication through other mediums (like Slack), or Disqus may not have worked for my…
Introduction 
 I was introduced to Terraform in June of 2017, as my employer was using Terraform to manage their AWS resources and infrastructure for our product as we moved from an on-prem colo datacenter to an AWS Infra-hosted environment. However, the scope of use within Technical Operations infrastructure still was in it’s early stages, specifically for services like Okta, Meraki,…

 What are we trying to achieve? 
 The SQL Code / Kolide Check 
 
 What does this do? 
 
 
 The results 
 
 What are we trying to achieve? 
 There are many ways to configure or restrict administrators on a local device potentially. However, none of this will work with misconfigured Azure AD environments or individuals who find ways to break your…
Introduction 
 There are times when you may need to incorporate Guests in your Slack Workspace(s). While Okta does not support this over their default OIN application, and they push you towards Okta Workflows as a way to potentially resolve this situation it could be potentially safer to separate the applications and configurations for Employees and Consultants/Contractors potentially for…

 A Brief Summary 
 My Expectations for This Project 
 What Does Our Security Model Look Like Today? 
 Why Device Assurance Is Essential for Large Businesses 
 So, What Do We Do? 
 
 Investigating Options 
 
 Kolide 
 Okta’s Device Assurance as Part of Okta Verify 
 Crowdstrike Falcon Foundry 
 FleetDM 
 
 
 So, Kolide Is the Winner for…