An extra security layer that sits between the Windows login and the Microsoft cloud service.
The problem
Classic login chains have a single weak point: whoever knows the credentials is in, no matter the path. Without a second, independent channel, even a strong password won't help once it has been intercepted.
The solution
An auth sidecar that confirms the sign-in through a second, independent channel (for example your phone). The login key is split and encrypted so that neither side can see the other, and if anything goes wrong, the door stays locked.
Distributed verification architecture: Auth sidecar between Windows login and Microsoft Entra with out-of-band 2FA binding, cryptographic payload splitting (AES-256-GCM, byte-range) and a fail-closed policy so no trust source sees the other
Orchestrator: FastAPI (Python 3.12) with mTLS termination via Caddy and an adapter pattern for multiple 2FA backends (mobile OTP, sign-in app)
Test suite: 238/238 automated tests green (pytest, ruff clean)
Threat modeling: STRIDE across 4 trust boundaries, HMAC-based inter-service authentication, nonce replay protection, a killswitch against default secrets, and categorized audit logging
Result
Complete logging and protection against reuse of intercepted login data
Extensive automated tests as a safety net against regressions
Fail-closed principle: failures leave the door locked, not open
