Identity Management

Identity Management

What I Do

I provide guidance on managing digital identities across applications and services. This includes implementing authentication protocols (OAuth 2.0, OIDC, SAML), single sign-on, multi-factor authentication, identity federation, user provisioning/deprovisioning, and session management.

When to Use Me

• Implementing OAuth 2.0 or OpenID Connect authentication flows
• Setting up single sign-on across multiple applications
• Adding multi-factor authentication to existing systems
• Designing user provisioning and deprovisioning workflows
• Implementing SCIM for automated identity lifecycle management
• Configuring SAML federation with enterprise identity providers

Core Concepts

1. OAuth 2.0: Authorization framework for delegated access using access tokens without sharing credentials.
2. OpenID Connect (OIDC): Identity layer on top of OAuth 2.0 that provides authentication and user identity claims.
3. SAML 2.0: XML-based framework for exchanging authentication and authorization data between identity and service providers.
4. Multi-Factor Authentication: Requiring two or more verification factors (knowledge, possession, inherence) for authentication.
5. Single Sign-On (SSO): Authenticate once and access multiple applications without re-entering credentials.
6. SCIM: System for Cross-domain Identity Management protocol for automated user provisioning and deprovisioning.
7. Session Management: Creating, maintaining, and invalidating user sessions securely across requests.
8. Identity Federation: Linking identities across different identity providers and trust domains.

Code Examples

1. OAuth 2.0 Authorization Code Flow with PKCE (Python)

import secrets
import hashlib
import base64
from urllib.parse import urlencode

def generate_pkce_pair() -> tuple:
    verifier = secrets.token_urlsafe(64)
    challenge = base64.urlsafe_b64encode(
        hashlib.sha256(verifier.encode()).digest()
    ).rstrip(b"=").decode()
    return verifier, challenge

def build_authorization_url(
    auth_endpoint: str,
    client_id: str,
    redirect_uri: str,
    scopes: list,
) -> tuple:
    state = secrets.token_urlsafe(32)
    verifier, challenge = generate_pkce_pair()
    params = {
        "response_type": "code",
        "client_id": client_id,
        "redirect_uri": redirect_uri,
        "scope": " ".join(scopes),
        "state": state,
        "code_challenge": challenge,
        "code_challenge_method": "S256",
    }
    return f"{auth_endpoint}?{urlencode(params)}", state, verifier

2. JWT Token Validation (Python)

import jwt
from typing import Dict, Any, Optional
from datetime import datetime, timezone

def validate_token(
    token: str,
    public_key: str,
    expected_issuer: str,
    expected_audience: str,
) -> Optional[Dict[str, Any]]:
    try:
        payload = jwt.decode(
            token,
            public_key,
            algorithms=["RS256", "ES256"],
            issuer=expected_issuer,
            audience=expected_audience,
            options={
                "require": ["exp", "iss", "aud", "sub", "iat"],
                "verify_exp": True,
                "verify_iss": True,
                "verify_aud": True,
            },
        )
        return payload
    except jwt.ExpiredSignatureError:
        return None
    except jwt.InvalidTokenError:
        return None

3. Secure Session Management (Python/Flask)

import secrets
from datetime import datetime, timedelta, timezone
from typing import Optional, Dict, Any

class SessionManager:
    def __init__(self, max_age_minutes: int = 30, max_idle_minutes: int = 15):
        self.sessions: Dict[str, Dict[str, Any]] = {}
        self.max_age = timedelta(minutes=max_age_minutes)
        self.max_idle = timedelta(minutes=max_idle_minutes)

    def create_session(self, user_id: str, metadata: Dict[str, Any]) -> str:
        session_id = secrets.token_urlsafe(32)
        now = datetime.now(timezone.utc)
        self.sessions[session_id] = {
            "user_id": user_id,
            "created_at": now,
            "last_active": now,
            "metadata": metadata,
        }
        return session_id

    def validate_session(self, session_id: str) -> Optional[Dict[str, Any]]:
        session = self.sessions.get(session_id)
        if not session:
            return None
        now = datetime.now(timezone.utc)
        if now - session["created_at"] > self.max_age:
            del self.sessions[session_id]
            return None
        if now - session["last_active"] > self.max_idle:
            del self.sessions[session_id]
            return None
        session["last_active"] = now
        return session

    def destroy_session(self, session_id: str) -> None:
        self.sessions.pop(session_id, None)

Best Practices

1. Use PKCE for all OAuth 2.0 flows including confidential clients for defense in depth.
2. Validate JWTs fully including signature, expiration, issuer, audience, and required claims.
3. Implement token refresh rotation where each refresh token can only be used once.
4. Enforce MFA for sensitive operations even if the user authenticated with MFA at login.
5. Automate deprovisioning via SCIM to ensure access is revoked immediately when users leave.
6. Use short-lived access tokens (5-15 minutes) with longer-lived refresh tokens stored securely.
7. Bind sessions to client attributes (IP range, user-agent) to detect session hijacking.
8. Regenerate session identifiers after authentication to prevent session fixation.
9. Implement account lockout with exponential backoff after repeated authentication failures.
10. Log all authentication events including successes, failures, token refreshes, and logouts.