Posted: 2026 | Category: Identity & Platform

The Last Day Problem

Someone resigns. Their last day is Friday. On Thursday afternoon somebody in the office starts a list.

Email, obviously. The project tool. The invoicing app. The fleet thing nobody uses but everybody has an account for. The demo hosting. The CRM the sales guy set up in 2023 and never told anyone about. The dashboard with the client numbers on it.

Seven tools, seven admin panels, seven “are you sure you want to remove this user” dialogs. And that is only the ones you remembered.

Three months later somebody notices the ex-colleague still has a working login on the eighth tool.

Nobody was being careless. There was just no list, because there was never one place where the list could live.

This is what happens to every company that builds or buys more than two internal applications. Each one arrives with its own user table. Its own password reset flow. Its own idea of what an admin is.

The costs are quiet but real:

Onboarding takes days, not minutes, because a new hire needs seven accounts created by hand
Passwords get reused across all seven, because nobody memorises seven strong ones
Nobody can answer “who has access to what” without opening seven admin panels
Offboarding is a checklist somebody has to remember, and checklists get forgotten

The usual advice is to buy an enterprise identity suite. Then you find out it prices per user per month, wants a six-week onboarding, and expects your internal tools to speak a dialect of SAML that nobody on your team has read the spec for.

An open-plan office late in the day, one monitor fringed with sticky notes and a ring of labelled keys and access fobs left on the desk Seven applications, seven ways in, and seven places to remember on somebody’s last day.

How We Glued It Shut

DASH is the front door. One identity, one dashboard of tiles, one place to switch someone off.

It is a full OpenID Connect provider. Your internal apps stop keeping their own login screens and delegate to DASH instead. The user clicks a tile, DASH signs a token, the app trusts it and lets them in. No second password. No second user list.

Step 1: Register the app. In the superadmin panel you add a connected app: name, slug, base URL, redirect URIs, an emoji. DASH mints an OIDC client secret and an RSA key pair. The app gets the public key; DASH keeps the private one and is the only thing that can sign a token.

Step 2: The app trusts DASH. The connected app adds the standard authorization-code flow. It is the same protocol Google and Microsoft speak, so any library already supports it. Existing accounts are linked once, matching the DASH user to the local one, and after that the link is permanent.

Step 3: The tile appears. The user opens dash.glue.blue and sees the tools they are allowed to use, grouped into sections, with an icon and a colour. Click, and you are inside, already logged in.

Step 4: One place to switch things off. Deactivate a user in DASH and every connected app closes behind them. Sessions are tracked in Redis and checked on every request, so revoking is immediate rather than “whenever the token expires”.

One sign-in reaches every application, and one switch takes them all back.

What Is Actually In It

Single Sign-On That Speaks a Real Protocol

Full OpenID Connect provider, authorization-code flow, RS256-signed tokens
Refresh-token rotation with theft detection, which revokes the whole token family when a stolen token is replayed
Per-app audit log of every SSO event, so “when did they last log in to that” has an answer
Device authorization flow for anything without a browser

A Dashboard That Is Actually a Dashboard

Tiles for every internal tool, grouped into sections you name yourself
Per-workspace, so a contractor sees three tiles and the finance lead sees eleven
Ordering, icons, accent colours, and archiving for tools you retire but do not want to forget

Workspaces and a Real User Directory

Multi-tenant from the ground up: every piece of data belongs to a workspace
Roles of admin, user and viewer, with invitations by email
One directory of who exists, what they can reach, and when they last used it

Password, Google, or a passkey
Passkeys mean the laptop’s fingerprint sensor replaces the password entirely
Waiting-list mode with email verification and invite codes, for when you want to open the door slowly

Feature Flags at Two Levels

Flags per workspace and per individual user, in three states: on, disabled, hidden
Ship a half-finished feature to one workspace, or to one person, without a branch and without a deploy
Hidden means the UI does not even hint the feature exists

Superadmin Tools for the Person Who Owns All Of It

A view across every workspace, every user, every connected app
Impersonation, fully logged with a start and end timestamp, so support can reproduce the bug instead of asking for a screenshot
Global registration switch, system settings, waiting-list management

API Keys and Automation

Scoped API keys for scripts and CI
A Claude Code skill, so workspaces, apps and flags can be managed from a terminal instead of a browser

An office manager's desk on somebody's last day: a returned laptop and badge on the corner, a handwritten checklist half ticked off under a coffee ring Somebody always ends up owning the leaving list. It should not be a piece of paper.

Who This Unsticks

Small Companies With Too Many Tools

You did not plan to run seven internal applications. It just happened, one useful thing at a time. DASH gives you the front door those seven tools never came with, without replacing any of them.

Teams Building Their Own Software

Every new internal app costs you an auth system: login page, password reset, email verification, sessions. Register the app, wire the standard flow, move on to the part that is actually your product.

DASH makes an auth system a configuration step instead of a sprint.

Whoever Handles Offboarding

Usually the office manager, usually with a spreadsheet. One switch instead of seven admin panels, and an audit log that proves it happened.

Built On Real Traffic

DASH is not a slide. It is the live identity layer for the Glueblue applications — the demo hosting, the fleet platform, the pre-calculation tool. Every one of them signs in through it. When we say a connected app takes an afternoon to wire up, that is because we have done it repeatedly, written the runbook, and then followed our own runbook.

The OIDC implementation has been through a security assessment covering redirect-URI validation, token rotation, session revocation and secret handling. We publish the findings to ourselves and fix them. That is less glamorous than a compliance badge and considerably more useful.

Get Started

Still creating seven accounts by hand for every new hire? Still hoping you remembered every tool on somebody’s last day?

Get a front door.

Visit dash.glue.blue. Register your first connected app, wire up the standard flow, and watch the tile appear.

DASH is built by glue.blue - we stick solutions to problems. Permanently.

Ready for one login instead of seven? → Get Started → Contact Us

Posted in: Identity, Single Sign-On, Platform, Internal Tools

DASH: One Login, One Dashboard, One Off Switch