Not looking for your source code, what shape did your solution take? Does it single sign on? Single sign off? How do you convey permissions and groups? Is your app the source of truth, or do you read users and groups out of another IdP?