Johnie Karr
Sr. Software Engineer, Hygiena
London, Kentucky, United States
Actions
Johnie Karr is a Senior Software Engineer at Hygiena, where he builds APIs for the food safety industry. With almost 20 years building enterprise software — including a nationally-recognized funding platform for Kentucky Housing Corporation and backend systems for organizations like the International Student Exchange Program and ScholarRx — he's spent a career in the unglamorous but critical parts of applications: authentication, data architecture, and the decisions that determine whether a system scales gracefully or falls over.
Johnie is a Six Sigma Yellow Belt with certifications in SQL Server administration and HIPAA security, and has volunteered on his church's IT team since 2012.
Area of Expertise
Topics
From Local Auth to SSO: A Practical Migration Playbook
Your app has its own username and password table. Then leadership decides everyone needs to log in through SSO — and now every existing user, every stored credential, and every login flow you've already built has to change.
In this hands-on session, you migrate a real application from local authentication to an external identity provider, working against a pre-configured Microsoft Entra External ID tenant provided for the workshop — no setup required. We use Entra as the working example, but the decisions apply whether you land on Entra, Okta, Auth0, or anywhere else: mapping existing user records to identities in the new provider, managing the cutover period where some users are migrated and others aren't, safely invalidating old credentials, and what an actual rollback plan looks like when something doesn't go as planned.
The hands-on lab uses a C# sample application — you don't need production C# experience, just enough comfort reading code to follow along — but the migration decisions themselves apply regardless of what your own application is written in.
You'll leave with a migration checklist you can apply against your own user store, regardless of which identity provider you land on.
Designing Secure Authentication: What Happens Beyond the Login Form
Designing Secure Authentication: What Happens Beyond the Login Form
Every application needs authentication — but secure authentication is more than hashing a password and issuing a token. It's about designing the entire user journey thoughtfully: registration, login, error messaging, password resets, and recovery.
If you're building or maintaining any application with a login screen — regardless of language or framework — this session is for you. We explore the real-world decisions developers make when building authentication systems: proper password hashing (and why encryption isn't enough), practical password policies, defending against user enumeration, secure reset flows, and integrating with password managers. Through practical examples, we examine how small design choices strengthen or weaken an application's security posture.
You'll leave with a checklist you can run against your own login flow, and specific, actionable changes to make — no framework required.
From One Customer to Many: Converting a Single-Tenant Application to Multi-Tenant
Many applications start as single-tenant systems — built for one customer, one database, and one set of assumptions. But what happens when the business needs to scale to multiple customers without rewriting everything?
In this session, we’ll walk through the practical challenges of converting a single-tenant .NET application into a multi-tenant system. We’ll explore database strategies (shared vs isolated), tenant resolution patterns, authentication implications, performance considerations, and the subtle assumptions that break during migration. Rather than presenting a theoretical ideal architecture, this talk focuses on real-world tradeoffs, pitfalls, and lessons learned when evolving an existing system.
Attendees will leave with a practical framework for evaluating and implementing multi-tenancy in their own applications.
10 Underused .NET Features That Make You Look Like a Wizard
Most of us rely on the same small set of tools in our day-to-day .NET development. But when production issues arise, performance degrades, or edge cases appear, knowing a few lesser-used features can feel like magic.
In this session, we’ll explore ten practical and often overlooked .NET and EF Core features that can dramatically improve debugging, performance insight, and architectural clarity. Topics include compiler directives, EF Core global query filters (and their gotchas), inspecting generated SQL, surfacing query parameters, and other tools that become invaluable when systems grow in complexity.
You may not use these features every day — but when you need them, you’ll look like a wizard for knowing they exist.
Stop Repeating Your Where Clause: Meet EF Core Global Query Filters
How many times have you written the same Where clause in your EF Core queries?
Soft deletes. Multi-tenant filtering. “Only active” records. We copy and paste the same conditions across repositories, services, and controllers — hoping we don’t forget one.
EF Core has a built-in feature that can automatically apply those filters to every query: Global Query Filters.
In this lightning talk, you’ll learn what Global Query Filters are, how to configure them in just a few lines of code, and when they make your codebase dramatically cleaner. We’ll walk through a simple example (soft deletes and tenant isolation), see how the filter is applied automatically, and look at the one thing you must know to avoid surprises.
If you’re using EF Core and repeating filtering logic throughout your application, this talk will give you a simple, practical tool you can use immediately.
Building Secure Authentication From Scratch: A Hands-On, Any-Language Workshop
You know you're supposed to hash and salt passwords. But what actually goes into a secure authentication system once you get past "call this library"?
In this hands-on workshop, you build a complete authentication system from the ground up, starting from a bare static HTML frontend (provided) and ending with a working, defensible login flow behind it. Implement registration with salted (and peppered) password hashing, login with session handling, account lockout, and a full password reset flow — plus the design decisions that separate "it compiles" from "it's actually secure."
You'll use whatever backend stack you want for this workshop, or you can follow along step-by-step with the provided C# reference implementation.
You'll leave with a working authentication system in a language you actually use, plus a checklist of the decisions to revisit the next time you build or audit a login flow.
Please note that Sessionize is not responsible for the accuracy or validity of the data provided by speakers. If you suspect this profile to be fake or spam, please let us know.
Jump to top