Can you give an example of rolling your own auth the wrong way? Sometimes I get frustrated by the built-in auth in web frameworks, especially when designing sin

Can you give an example of rolling your own auth the wrong way? Sometimes I get frustrated by the built-in auth in web frameworks, especially when designing single sign on, but I'm not sure which components are must-keeps, versus being replaceable.