Engineering notes
Blog
Write-ups on Common Login Portal — the identity and single-sign-on platform I built solo, backend to frontend, for Oman's National Port Community System. The actual failures, the wrong turns, and what fixed them.
13 Aug 2026
AVA not a sequence: a Java 17 SAML cert bug
Java 17's stricter X.509 parser rejected a government IdP's SAML certificate. The fix: parse it with BouncyCastle instead.
13 Aug 2026
Hot-reloading a SAML signing certificate in prod
A cached SAML certificate breaks the moment an IdP rotates it. Making it hot-reloadable with automatic on-failure refresh.
13 Aug 2026
Bank Muscat Error 10001: a GET that ate a POST
A browser GET to Bank Muscat's payment endpoint silently dropped the POST body. The fix: a backend-rendered auto-submit form.
13 Aug 2026
Three clocks racing: a payment reconciliation bug
An invoice expiry, a frontend poll, and a backend reconciliation job all kept their own clock. Two finalization paths and an idempotency guard fixed it.
13 Aug 2026
It was never the network
Intermittent 500s and 503s looked like India–Oman latency. A 60-second timeout against 100–250ms real RTT proved it wasn't.
13 Aug 2026
Fixing IDOR properly
A pentest found five IDOR-class findings. The fix was object-level authorization plus a regression suite that replays every proof-of-concept.
13 Aug 2026
Spring Data JPA's null-version trap
@Version plus save() on a fresh entity throws duplicate-key errors, not optimistic-lock exceptions. The find-then-update pattern that fixes it.
13 Aug 2026
Designing an SSO handshake with no standard
No RFC covers silently launching a downstream app after your own SSO event. Designing a one-time-token handshake from scratch.
13 Aug 2026
Hand-rolling SOAP clients against undocumented APIs
Two government SOAP APIs, neither with a usable WSDL. Building the client by hand with DOM and XPath instead.
13 Aug 2026
Hexagonal architecture you can verify with grep
Anyone can claim hexagonal architecture. The real test: grep the domain package for framework imports.
13 Aug 2026
Angular 18 to 21: 48 vulnerabilities down to 2
A mid-project major-version upgrade, done to close an npm audit backlog before a VAPT cycle.
13 Aug 2026
Mock and real adapters behind every port
Every external dependency had a mock and a real adapter behind the same port. What that bought, and what it couldn't.