Migrating 200,000+ users off a legacy login system
Software Engineer · Bonterra · 2022 – Present
Designed a custom MFA/OTP system and led a phased SSO migration off a legacy login system, securing 200,000+ users end to end.
Context
The platform's login system had aged past what current security expectations require for an enterprise SaaS product serving large institutional clients. The hard constraint wasn't the new identity system itself; it was moving an entire active production user base onto it without a service interruption anyone would notice.
Approach
The MFA/OTP backend was built as an AWS Lambda service, paired with React frontend flows covering device management, session-timeout enforcement, and account recovery. Account recovery ended up being its own project: years of legacy accounts meant inconsistent contact info on file, and the recovery flow had to handle that gracefully rather than lock people out.
Rather than a single cutover, the SSO migration ran in phases: cohorts of the user base moved over incrementally, with both the legacy and new auth paths live simultaneously during the transition window. That gave room to catch integration issues on a subset of traffic before they could reach the full 200,000+ users.
Outcome
The full user base was migrated onto the new SSO/MFA system, and the legacy login path was decommissioned once migration completed, closing a long-standing identity security gap without a disruptive flip.