Architecting an identity-provider-embedded biometric auth flow to replace a legacy vendor

The problem

Lulalend needed to replace their legacy biometric MFA vendor for both login step-up and high-value payment authorization — but their entire auth layer lived inside Keycloak, a locked-down identity provider that blocks most inbound callbacks and wasn’t designed for embedding third-party capture widgets.

My approach

Steered the integration away from a JS SDK (which loses key anti-spoof signals like device fingerprinting and network checks) toward a hosted, iframe-embedded capture flow, and moved result delivery from callbacks to status polling to work around the platform’s inbound traffic restrictions. Designed a decision-tree approach using immutable result codes rather than the partner’s initially-proposed mutable status object.

What I built

A POC architecture spanning backend token generation and polling, an iframe-embedded hosted capture flow inside the identity provider, and a batch migration plan for enrolling existing users onto a new face map without requiring re-capture until their next login.