Notifications
Clear all
Topic starter
16/08/2026 1:11 pm
TL;DR: SaaS identity features such as SSO, MFA, provisioning, and audit trails can be extended into on-premises and hybrid deployments using static project keys, firewall allowlisting, reverse tunnels, and customer-managed IdPs, according to Descope. The core issue is that hybrid CIAM still depends on durable credentials and bidirectional network trust, which expands the NHI governance burden.
NHIMG editorial — based on content published by Descope: Using Descope With On-Premises B2B Customers
By the numbers:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials.
- 33% of organisations report their AI agents have accessed inappropriate or sensitive data beyond their intended scope.
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: How should security teams handle API keys and tokens as part of identity governance?
A: Security teams should treat API keys and tokens as governed identities, not just technical secrets.
Q: Why do on-premises SSO and webhook integrations increase identity risk?
A: They increase risk because authentication now depends on both credential handling and network trust.
Q: What breaks when reverse tunnels become the default for identity traffic?
A: The main failure is control drift.
Practitioner guidance
- Inventory every customer-specific API key Map each Descope project key to a named customer deployment, an owner, a storage location, and a revocation path.
- Restrict callback and webhook routes Allow inbound HTTPS only for the exact redirect and webhook endpoints needed for SSO, event delivery, and step-up flows.
- Govern tunnels as temporary identity infrastructure If reverse tunnels are required, document the approved use case, enforce certificate validation, and monitor uptime and reconnect behaviour.
What's in the full article
Descope's full guide covers the operational detail this post intentionally leaves for the source:
- Step-by-step setup for customer-specific project keys, including console navigation and secret distribution.
- Exact firewall, ACL, and proxy requirements for production SSO, hosted flows, and webhook delivery.
- ngrok and Cloudflare Tunnel configuration steps for testing and constrained deployment scenarios.
- On-premises IdP setup details for ADFS, PingFederate, ForgeRock, Shibboleth, and Keycloak.
👉 Read Descope's guide to on-premises B2B identity deployment →
On-premises B2B identity: where static keys and tunnels create risk?
Explore further
16/08/2026 1:13 pm
Static project keys are the core NHI governance exposure in hybrid CIAM. The article’s recommended per-customer key model is structurally safer than shared credentials, but it still leaves organisations dependent on long-lived secrets that must be distributed, stored, and revoked across customer environments. That is a classic non-human identity lifecycle problem, not just a deployment detail. The practitioner conclusion is that every on-prem deployment should be governed like a separate NHI estate.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials, according to AI Agents: The New Attack Surface report.
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: How do hybrid identity teams decide between direct network rules and tunnels?
A: Use direct network rules for production when the customer environment can support stable allowlisting and route ownership. Use tunnels only for testing or constrained deployments where the exception is explicitly documented and monitored. The decision should be based on governability, not convenience alone.
👉 Read our full editorial: Descope’s on-premises B2B identity model exposes static key risk
