Engineering Enterprise Identity: Orchestration Patterns for a Unified Access Platform across Lines of Business
DOI:
https://doi.org/10.63282/3117-5481/AIJCST-V6I2P113Keywords:
Enterprise Identity Management, Identity and Access Management (IAM), Identity Orchestration, Authentication, Multi-Factor Authentication (MFA), Identity Federation, Access Control, Risk-based Authentication, Credential Management, Identity Governance, NIST SP 800-63, Unified Access Platform, Lines of Business (LOBs), Digital Identity, Enterprise SecurityAbstract
Large enterprises that grow through acquisition and independently funded lines of business (LOBs) accumulate fragmented identity estates: duplicate credential stores, divergent multi-factor authentication (MFA) policies, and no single authoritative answer to where a given identity holds access. This article describes an architectural pattern for consolidating such an estate onto a single orchestration-centred Identity and Access Management (IAM) platform without requiring LOB applications to be rebuilt. The pattern separates a policy-owning orchestration engine from a purpose-partitioned gateway tier. It expresses authentication, access recovery, and credential creation as composable journeys that share a common risk engine and authenticator abstraction. Federation is treated as three distinct trust directions external inbound, internal LOB-to-LOB, and outbound to third-party service providers sharing infrastructure but not trust models. The article maps each design decision to the relevant guidance in NIST SP 800-63, and closes with observed outcomes, limitations, and the conditions under which the pattern does not generalise.
References
[1] FFIEC, "FFIEC Issues Guidance on Authentication and Access to Financial Institution Services and Systems," Ffiec.gov, February 20, 2025. http://www.ffiec.gov/news/press-releases/2021/pr-08-11.
[2] H. Flanagan (Editor), "Terminology in the IDPro Body of Knowledge," IDPro Body of Knowledge, vol. 1, no. 7, Sept. 2021, doi: 10.55621/idpro.41.
[3] P. A. Grassi et al., National Institute of Standards and Technology, "Digital identity guidelines: authentication and lifecycle management," NIST Special Publication 800-63B, June 2017, doi: 10.6028/nist.sp.800-63b.
[4] P. A. Grassi et al., National Institute of Standards and Technology, "Digital identity guidelines: federation and assertions," June 2017, doi: 10.6028/nist.sp.800-63c.
[5] Natsuhiko Sakimura, John Bradley, Michael B. Jones, Breno de Medeiros, and Chuck Mortimore, "Final: OpenID Connect Core 1.0 incorporating errata set 1," openid.net. https://openid.net/specs/openid-connect-core-1_0.html
[6] D. Hardt, "The OAuth 2.0 Authorisation Framework," Oct. 2012, doi: 10.17487/rfc6749.
[7] Gaithersburg, MD: U.S. Department of Commerce, Joint Task Force, National Institute of Standards and Technology, "Security and Privacy Controls for Information Systems and Organisations," Security and Privacy Controls for Information Systems and Organisations, vol. 5, no. 5, Sept. 2020, doi: 10.6028/nist.sp.800-53r5.
[8] M. Jones, J. Bradley, and N. Sakimura, "JSON Web Token (JWT)," May 2015, doi: 10.17487/rfc7519.
[9] S. Jain, M. Mandell Freeman, B. Biggio, M. Duermuth, and G. Giacinto, "Who Are You? A Statistical Approach to Measuring User Authenticity," Jan. 2016, doi: 10.14722/ndss.2016.23240.
[10] B. Campbell, J. Bradley, N. Sakimura, and T. Lodderstedt, "OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens," Feb. 2020, doi: 10.17487/rfc8705.
[11] David Freeman, Sakshi Jain, Markus Dürmuth, Battista Biggio, and Giorgio Giacinto, "Assertions and Protocols for the OASIS Security Assertion Markup Language (SAML) V2.0."[Online]. Available: https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf
[12] S. Cantor, J. Moreh, R. Philpott, E. Maler, "Metadata for the OASIS Security Assertion Markup Language (SAML) V2.0, OASIS Standard, March 15 2005.
[13] World Wide Web Consortium, "Web Authentication: An API for accessing Public Key Credentials - Level 2," W3.org, April 08, 2021. https://www.w3.org/TR/webauthn-2/
[14] F. Com, / CISA, C. Gov, and C. Gov, "CISA | DEFEND TODAY, SECURE TOMORROW Implementing Phishing-Resistant MFA," 2022. [Online]. Available: https://www.cisa.gov/sites/default/files/2023-01/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf
[15] F. Com, / CISA, C. Gov, and C. Gov, "CISA | DEFEND TODAY, SECURE TOMORROW Implementing Number Matching in MFA Applications," 2022. [Online]. Available: https://www.cisa.gov/sites/default/files/publications/fact-sheet-implement-number-matching-in-mfa-applications-508c.pdf
[16] S. Rose, O. Borchert, S. Mitchell, and S. Connelly, "Zero trust architecture," NIST Special Publication 800-207, vol. 1, no. 800–207, Aug. 2020, doi: 10.6028/nist.sp.800-207.
[17] Lodderstedt, T., McGloin, M., & Hunt, P. (2013). OAuth 2.0 threat model and security considerations (RFC 6819). Internet Engineering Task Force. https://doi.org/10.17487/RFC6819
[18] Szalachowski, P. (2020). Password-authenticated decentralized identities. arXiv. https://doi.org/10.48550/arXiv.2007.15881
[19] P. A. Grassi, M. E. Garcia, and J. L. Fenton, Digital Identity Guidelines, NIST Special Publication 800-63-3, National Institute of Standards and Technology, Gaithersburg, MD, 2017. doi: 10.6028/NIST.SP.800-63-3.
[20] K. Grizzle, M. Ansari, E. Wahlstroem, and C. Mortimore, "System for Cross-domain Identity Management: Protocol," Internet Engineering Task Force, September 2015, doi: 10.17487/rfc7644.
