The situation
The insurer distributes through banks: each bank’s staff needs to reach the insurer’s quoting and policy systems, and each bank runs its own identity provider, on its own schedule, with its own idea of what an attribute is called.
Handled directly, that is a mesh. Every new bank means an integration with every relevant application, and every certificate rotation somewhere else becomes an incident here.
What was done
Monokee was placed between the two sides. Each bank federates once, with the broker; each application integrates once, with the broker. Protocol differences — a SAML-only application reached by users from an OIDC provider — are resolved in the middle, and attribute mapping lives in one readable place instead of being a property of each pairing.
Policy stayed with the insurer: authentication may have happened at the bank, but what it entitles someone to is the insurer’s decision, including asking for a further factor when the operation warrants it.
Monokee enabled us to act as an identity broker for some of Europe’s largest banks, with an implementation process that was far faster and simpler than we expected.
— Head of IT, insurance company
What changed
- Onboarding a new distribution partner is a configuration, not a project.
- Protocol mismatches stopped excluding applications from single sign-on.
- Upstream certificate rotations became routine maintenance.
Where to go next
The arithmetic behind this is on the Identity brokering and federation page — the reason the cost grows with the product of the two sides, not the sum.