Chapter 4: Core Architectural Concepts – Identity and Access Management

In this chapter, we will continue our efforts to understand the general architectural concepts that a Salesforce CTA should be familiar with. Identity and access management (IAM) is one of the most challenging topics that an architect needs to deal with. During a normal project, you might find yourself working with multiple IAM experts from different technological backgrounds. You need to be able to speak the same language as they do, understand their vision, and challenge their architectural design (if needed). As a Salesforce CTA, you are expected to step away from the standard platform knowledge to provide expert guidance in other related matters. Integration was a good example, IAM is another.

In this chapter, we're going to cover the following main topics:

• Understanding the general concepts of IAM
• Becoming familiar with the common IAM standards
• Understanding the key authentication...

Understanding the general concepts of IAM

The IAM architecture is the activity of defining the processes, tools, monitoring mechanisms, and governance required in order to grant the enterprise's internal and external users access to the right digital assets in a well-governed and secure manner. The IAM architecture needs to ensure that users are granted the right level of access privileges based on internal and external requirements, such as enterprise policies or regulatory compliance.

The users included in an IAM architecture could be external (and in this case, we usually use the term customer identity and access management (CIAM)) or internal (where we simply use the term IAM).

The IAM strategy aims at creating a unified digital identity for the enterprise's customers and employees, along with a set of tools and processes to manage this identity and the access rights associated with it.

The IAM architecture is critical in today's connected enterprise applications...

Becoming familiar with the common IAM standards

IAM is a complex domain, and in order to ensure that its desired functionalities are delivered in a secure, consistent, and compliant way, several standards and protocols have been developed throughout time. As an architect, you need to become very familiar with these standards, understand how they operate and how they differ from one another, and exactly when to propose using any of them. Moreover, some of these standards have known and well-defined processes that describe precisely how to use the given standard to authenticate a user for a given use case. These processes are referred to as the authentication flows.

To understand the authentication and authorization concept and how standards are used therein, let's take a simple example. Assume you are traveling from the UK to the USA. When you attempt to cross the US border control, they would want to verify your identity. And let's assume that there is also a need to...

Understanding the key authentication flows

For each of the following flows, we will go through the flow's sequence diagram, cover the high-level details of each step, and provide potential use cases and key considerations. In order to draw and read a sequence diagram properly, you need to make yourself familiar with the standard symbols used. The following diagram lists the most common UML sequence diagram symbols:

Figure 4.5 – Common sequence diagram symbols

These flows are not specific to Salesforce; they are open standards and used across different technologies. You need to become very familiar with all of them. During the CTA review board, you will likely need to explain one of these flows. The best way to explain a flow is to draw its sequence diagram and walk the audience through it. It is strongly recommended that you practice drawing these diagrams over and over until you fully memorize them. Also, practice explaining them to an audience...

Summary

This was a long chapter, full of in-depth technical knowledge. We started by covering some general concepts regarding IAM. We learned the importance of crafting a well-designed IAM strategy and how that could significantly impact the end user experience as well as overall system security and compliance. We then became familiar with some key IAM terms and definitions, including identity, authentication, authorization, identity store, and others. We then moved on to discover some of the most common IAM standards, including SAML, OAuth2.0, OpenID Connect, and Kerberos, along with the different types of tokens they generate or use, such as the access token, refresh token, session token, and ID token.

That all set the scene to dive deeper into some of the common and standard authentication flows. We had an in-depth review of nine different flows, including SAML IDP-initiated, SAML SP-initiated, OAuth web server, OAuth JWT flows, and others.

That concludes this part of the...