Backend security, authentication and access control for PHP applications

The hard part of application security is rarely the cryptography. It is doing the work on a system that is already live, already has users, and cannot have a weekend of downtime while you rearrange its authentication.

That is the version I have shipped, more than once.

What this looks like

• Single sign-on — full OpenID Connect integration: login flow, secure account linking between your application and the identity provider, optional enforcement so every user authenticates through the IdP, just-in-time user provisioning, and the admin tooling to link and unlink accounts.
• Two-factor authentication — TOTP, email codes and backup codes, with the recovery paths that decide whether a 2FA rollout survives contact with real users.
• Role-based access control on Symfony's security layer: roles, voters, and an authorization model that stays legible as the permission matrix grows.
• Hardening existing applications — session handling, credential storage, access-control gaps, and dependency exposure in long-lived codebases.

Why this is a specialism and not a checkbox

Authentication is the one subsystem where a partial job is worse than none, because it looks finished. I would rather scope a smaller piece and finish it properly than hand back something that passes a demo.

If you want a second pair of eyes before a launch, a scoped review is usually the cheapest useful thing I can do.