IDAAS core

The Identity and Access (IDAAS) core is the secure and stable foundation for the OneWelcome Identity Platform. It provides the common, shared identity and access functions needed by the other identity applications to perform their business-specific functions. It hosts functions such as the identity store, authentication engine, access component, event store, and credential store.

Most identity applications require generic functionality such as knowledge about identity, an authentication service, or a central location to store all generated events. That’s exactly what the IDAAS core provides. It is a REST API-enabled component that supports open standards for the functions that it provides. For example, for authentication, it supports SAML and OIDC, for access, it supports OAuth, and for identity manipulation, it supports SCIM.

Identity store

The Identity store is where all identity-related data is stored. The data model is based on SCIM and supports multiple SCIM schemas. The OneWelcome Identity Platform provides the Core and OneWelcome extension schemas. To provide maximum flexibility and support any attributes that you need, you can create additional schemas. You can manipulate the identity records through the SCIM API with fine-grained authorizations. This results in a very flexible data model.

In addition to the actual attributes, the identity store stores metadata based on NIST 8112. The metadata provides the necessary context for understanding the value of the actual attribute. For example, the metadata stores when the attribute was created and last updated, but also stores what processing purpose the user consented to, where the data came from, and what the trust level is.

Credential store

The Credential store stores the actual credentials, meaning usernames and passwords, for those accounts that are held locally. The credential store supports a wide range of hashing algorithms and can support pre-encoded passwords to allow for seamless migration of existing users into the OneWelcome Identity Platform.

Event store

The Event store stores all events that the platform generates. These events contain references to the identity record that the event applies to, the event type, and relevant data related to the event type. You should retain events for long-term retention and further processing.

Access component

The Access component provides the ability to connect with external applications for authentication and authorization. These applications, service providers (in SAML terminology) or clients (in OAuth or OIDC terminology), can integrate based on SAML, or on OAuth or OIDC. In these scenarios, the IDAAS core acts as the identity provider (IDP) or OpenID Provider (OP) for the applications, which authenticates users, establishes sessions, and issues assertions or tokens.

The access component has a strong relationship with the federation, authentication, and authorization components. Combined, they provide the needed capabilities to sign a user in, either with an internal or an external account.

Federation component

The Federation component provides the ability to connect to an external IDP. These can be, for instance, the social providers, like Google, Facebook and so on, national ID schemes (eIDs), or any other IDP that supports SAML or OIDC. The federation component takes care of attribute mapping and can, if configured, match the external user to an internal user and link both accounts.

Authentication component

The Authentication component takes care of the actual authentication and session management. Authentication can be done internally, with the locally stored credentials, or externally through the federation component. It supports single-factor, multi-factor, and step-up authentication. Supported authentication mechanisms include:

• Unique ID (UID) and password

• One-time password (OTP) (email, SMS, or voice)

• Time-based one-time password (TOTP)

• One-time link (Magic link)

• QR code (requires the Mobile Identity module)

• Push notification (requires the Mobile Identity module)

The authentication component also takes care of session management to provide single sign-on (SSO), and it can support SAML single logout (SLO) and token revocation (including front channel logout).

Authorization component

The Authorization component is the component that acts as the OP in terms of OAuth OIDC. This is the component that issues tokens based on internal provided data (like attributes) and issues the right claims for the relying party requesting access tokens.

Insights component

The Insights component provides basic reporting capabilities. Reports are provided on a per-customer basis and created as part of the onboarding process.