IAM and Java, combined
A certified ForgeRock / Ping specialist and a senior Java developer: I configure the platform and I build what configuration alone cannot deliver.
IAM consultant · Senior Java developer · Switzerland
Secure access, federated identity.
I help companies secure access to their applications: one sign-in for every tool, protected access, partners connected simply. To do this, I design, migrate and operate PingAM and PingDS (formerly ForgeRock) platforms and, a Java developer first and foremost, I write the authentication modules and extensions your platform needs myself.
What I bring
Critical platforms
Large-scale identity platforms that protect access to critical business applications, from design to production incident analysis.
Cloud and DevSecOps
Kubernetes on Azure and AWS, Helm, Terraform, Ansible, CI/CD pipelines and monitoring: repeatable, controlled deployments.
Core business
IAM & identity federation with Ping Identity
Identity federation lets your users sign in once and securely reach all their applications, in-house and partner alike. This is the field I work in every day.
PingAM (formerly ForgeRock Access Management)
- SAML2 identity provider (IdP) and service provider (SP)
- OpenID Connect provider and OAuth2 authorization server
- Authentication journeys, SSO and session management
- Multi-factor authentication (MFA), WebAuthn and FIDO2
- Migration from PingAM 6.5 to PingAM 7.5, starting from OpenAM 13.5 early in my career
- Security hardening and architecture reviews
Federation & protocols
- SAML 2.0: metadata, circles of trust, attribute mapping
- OpenID Connect: authorization code + PKCE, userinfo, claims
- OAuth2: client credentials (M2M), scopes, API security
- JWT: signing, validation, troubleshooting
- Design and troubleshooting of complex application integrations
PingDS, OpenDJ & LDAP directories
- Directory for identities, configuration and tokens
- Integration of IAM services with enterprise LDAP directories
- Docker images and administration tooling
Operations & support
- Production incident management and root-cause analysis
- Support for project teams connecting their applications to SSO
- Technical documentation and test kits
My primary language
Java development & IAM customization
An off-the-shelf identity platform never covers every need. As a senior Java developer, from Java 8 to Java 21, I have built several authentication modules and many PingAM customizations, after years spent on enterprise Spring applications.
Custom PingAM extensions
- Custom authentication modules and journey nodes
- OAuth2 customization: validators, claims and scopes
- Java components integrating with directories and internal services
- Customization of the PingAM application (WAR) and code porting during migrations
Applications & microservices
- Spring Boot microservices in Java 17 and 21, REST APIs
- Migration of monolithic applications to microservices
- JPA / Hibernate, Quarkus, data migration platforms
- Tested code: JUnit, Mockito, quality tracked with SonarQube
Know-how
Technical skills
Identity & security
Java development
Cloud & containers
CI/CD & automation
Observability
Enterprise Java foundations
How I can help
Services
-
IAM audit & architecture
Assessment of your identity platform, review of security and federation flows, then a prioritized roadmap.
-
Federation & SSO
PingAM rollout and onboarding of your applications and partners with SAML2, OpenID Connect and OAuth2.
-
PingAM extension development
Authentication modules, journey nodes, OAuth2 validators and claims written in Java, tested and documented.
-
Migration & upgrades
Moving from OpenAM or ForgeRock AM to recent PingAM versions, including porting your customizations.
-
Automation & operations
Kubernetes deployment, CI/CD pipelines, monitoring and support in resolving production incidents.
-
Java & Spring Boot reinforcement
Microservice development and API security, working alongside your team.
Sample engagements
Projects
Migration from PingAM 6.5 to 7.5
Contribution to the upgrade of a large-scale identity provider: authentication journeys, porting of Java customizations and deployment on Kubernetes.
Custom authentication modules
Java development of several authentication modules and nodes to cover needs the standard product does not address.
OAuth2 and OpenID Connect customization
Custom validators, claims and scopes to tailor tokens to application needs and secure APIs.
Authentication and federation services
Implementation of authentication services on OpenAM and OpenDJ: OAuth2, SAML2 and LDAP integrations, identity federation and technical documentation.
Java 21 microservices on Azure
Development of Spring Boot microservices deployed on Kubernetes with Helm, unit testing and new features.
Migration to a microservices architecture
Splitting an existing application into Java 11 microservices with Spring Boot and Quarkus, on AWS and Docker.
Background
Experience
-
June 2025 – present
SNCF IAM
IAM consultant and engineer
Design, operation and evolution of a large-scale IAM platform: migration to PingAM 7.5, authentication journeys, SSO and MFA, custom Java components.
-
November 2022 – December 2024
Swiss Risk & Care Java
Senior Java developer
Spring Boot microservices in Java 21, on Azure, Kubernetes and Helm.
-
April 2022 – October 2022
Scientific Games Java
Senior Java developer
Data migration platform in Java 17 and Spring Boot, with Docker, Prometheus and Grafana.
-
October 2019 – November 2020
Groupe SEB Java
Senior Java developer
Migration to a microservices architecture: Java 11, Spring Boot, Quarkus, AWS.
-
March 2017 – August 2018
Enedis IAM
IAM engineer
Authentication and federation services on OpenAM 13.5 and OpenDJ, within the security team.
-
Earlier
Senior Java developer and technical consultant
Groupama, Kuehne + Nagel, Cegelec, Bizerba, Fresenius Kabi, Enedis (Linky), Aspline, Atos: enterprise Java platforms, software architecture and integration projects.
Certifications
- ForgeRock FRX-AM-CSE
- ForgeRock FR-420 OpenAM
- ForgeRock FR-421 OpenAM
- Red Hat RHCSA
Education
- MIAGE, Claude Bernard University Lyon 1
- DUT in Computer Science
Adding a new string to my bow
Keycloak: specialization in progress
I am training on Keycloak, the leading open-source IAM solution. It complements my Ping expertise for organizations looking for an open-source alternative, or running both solutions side by side.
The standards are the same (SAML2, OpenID Connect, OAuth2) and Keycloak is extended in Java: my experience in federation and extension development carries over directly.
Learning roadmap
- Acquired SAML2 / OIDC / OAuth2 protocols and Java development
- Acquired Automated deployment on Kubernetes
- Acquired Realms, clients, LDAP user federation and identity brokering
- In progress Supporting migrations between PingAM and Keycloak
- Up next Java SPI extensions, themes and custom authentication flows
An IAM, federation or Java development project?
Audit, assignment or team reinforcement: based in Lyon, two hours from Geneva, I work across Switzerland, at your premises or remotely. Tell me about your context and I will get back to you quickly.