This engagement is a Staff Augmentation success story: rather than delivering a boxed project, Tuix embedded a senior developer directly into the client's team, extending their in-house capacity with specialized identity expertise for as long as they needed it.
The client, an enterprise marketplace group, operated several web applications, including ones acquired from other companies that continued running under their original brand. The front-end branding stayed separate, but the back-end goal was clear: unify everything under a single identity provider, cut the maintenance overhead of running multiple authentication systems in parallel, and do it without forcing millions of users through a password reset or a broken sign-in flow.
A senior Tuix developer joined the client's identity-engineering team as an embedded engineer for a full year, working inside the client's German time zone to stay in step with the rest of the team's day. Sitting inside the client's own sprints, tools, and code reviews, they helped design the migration strategy jointly with the in-house team and carried it through execution, architecture decisions, the lazy vs. bulk migration split, staged rollout, and the eventual retirement of the legacy identity providers. After the migration, the developer spent the remaining time working with the client's team to maintain and improve the new identity system before the project was completed.
One developer. One IdP. 4.2 Millions of users who never noticed a thing.
Before Migration
After Migration
Legacy multi-IdP landscape
The client's ecosystem included multiple platforms each using separate identity systems and legacy IdPs. This fragmented approach created operational complexity, inconsistent user experiences, and duplicated identity logic.
Centralized Identity with Auth0
We introduced Auth0 as the single Identity Provider (IdP) to centralize authentication and provide SSO across the platforms. The new architecture routes authentication through Auth0 while enabling staged coexistence with legacy IdPs during migration.
Lazy Migration (On-Login Migration)
For one product family, we implemented lazy migration: when a user logs in via the new Auth0 flow, the system first validates credentials against the legacy IdP (AWS Cognito). If successful, the user is migrated to Auth0 in real time with no disruption. This minimizes user friction and avoids mass resets.
Bulk Migration with Staged Rollout
For other product users, we ran a bulk migration script to import users into Auth0. To reduce risk, we used A/B testing and staged traffic shifts so a subset of users saw the new login flow early and allowed us to catch issues before full cutover.
Coexistence & Gradual Cutover
During migration, Auth0 and legacy IdPs coexisted. This allowed verification, throttling, rollback, and progressive routing changes to ensure zero downtime and a smooth user experience.
Identity & Auth
Auth0 new centralized Identity Provider (SSO, modern OIDC/OAuth flows). AWS Cognito & Custom IdPs Part of the legacy identity landscape. These systems were maintained during migration to ensure coexistence and a seamless transition without disrupting users.
Backend & Orchestration
AWS Lambda (TypeScript) lightweight migration/validation tasks and event-driven glue. AWS API Gateway secure routing for auth flows and migration endpoints.
Data & Storage
DynamoDB lightweight user-state or migration metadata (used in orchestration). S3 / CloudFront hosting assets or rollout frontends where necessary.
Frontend (consumer apps)
Vue.js / React consumer apps that now use Auth0 for authentication.
Lazy migration minimized friction for users by moving them seamlessly at first successful login instead of forcing password resets, prioritizing experience and retention over a faster but riskier cutover; bulk migration paired with A/B testing let the team validate the approach at scale and catch edge cases early rather than betting everything on a single risky moment; and consolidating onto Auth0 as a single source of identity truth simplified long-term identity management, improved the client's security posture, and enabled consistent SSO across every product going forward. These were the kind of tradeoffs that benefit from one engineer carrying the full context across the migration process, rather than decisions getting re-litigated each time a different consultant picked up the thread.
Automated on-login user migration flows (lazy migration). Scripted bulk migration pipeline with staged rollout and A/B testing. Zero-downtime cutovers through coexistence of legacy and new IdPs. Token and session handling unified under Auth0 for consistent SSO behavior.
Login success rates, error rates, latency, and user drop-offs were tracked in near real time during migration windows to catch issues early, every migration flow was designed to preserve password integrity and handle sensitive data securely with encrypted transit and storage, and rollback plans with staged throttles were ready to revert traffic to legacy IdPs if critical issues surfaced, with automated health checks and canary percentages controlling the pace of rollout. Being embedded for the full year meant the same engineer who built these safeguards was also the one watching them in production, so nothing about how the system behaved under real traffic had to be relearned by someone new.
Migrating millions of users required careful orchestration, chunked processing, and robust retry and compensation logic to handle failures gracefully; variations in stored credential formats and legacy auth behaviors needed targeted handling during lazy migration; and even a small disruption to the auth flow can cause real user churn, so every migration decision had to prioritize minimal visible impact over speed. Carrying that judgment consistently across a year-long migration was easier as a single embedded engineer who knew the system's history end to end, rather than something handed between people partway through.
