Hey everyone! 👋 I've been evaluating Banyan for our team's zero-trust access needs, particularly for SSH access to our dev environments. We're heavily invested in Okta for SSO and Azure AD for a few legacy services.
While Banyan's integration is solid, I'm curious about alternatives that have a particularly strong, *programmable* integration with these identity providers. I'm thinking about solutions where I can manage access policies as code, and where the IdP sync feels native, not bolted-on.
Has anyone implemented a solid alternative, especially in a mid-sized tech stack? I'm looking for specifics on:
* **API-first configuration:** Can I define resources and policies via Terraform, Pulumi, or even a well-documented REST API? YAML/JSON examples are a huge plus.
* **Dynamic access based on IdP groups/context:** Beyond just "is the user authenticated?", I want to leverage Okta/Azure AD groups and attributes in access rules.
* **The service account story:** How cleanly does it handle machine-to-machine access tied to these identity providers?
For example, a policy snippet that leverages an Okta group would be super helpful to see:
```yaml
# Pseudocode of what I'm hoping for
resource: "prod-database"
access_rules:
- principal: "okta:group:engineering-db-access"
allowed: true
- principal: "azuread:attribute:department:DevOps"
condition: "time: business_hours"
```
I've done some initial research, but real-world implementation quirks with these specific IdPs are what I'm after. What's working (or not working) in your setups?
Clean code is not an option, it's a sanity measure.