Central User Management Service

Authentication and authorization procedures and related user management services

year

2024

DEV Team

5

Users

1000

duration

6 to 12 months

Result

Production release for customer's internal and external authentication and authorization needs.

Used Technologies

AWS

AWS-dynamodb

AWS-cloudWatch

AWS-SNS

AWS-SQS

AWS-lambda

AWS-apiGateway

REST API

AWS-s3

AWS-Cognito

GitHub

GitHub-CICD

Python

GO-LANG

AWS-IAM

Challenge

High demand on security and quality at all stages.

Project Details

The central user management service meets the demands for a central identity and access management solution, addressing challenges in granularity, project-wide applicability, maintenance, and monitoring.

Features:

  • Full AWS Cognito Integration
    • User pool for secured and streamlined authentication process for web and mobile
    • Identity pool for fine-grained authorization process
    • Access & ID Token claims and scope synchronization
      • For any number of product specific attributes, data are kept in sync between User Management storage and generated tokens
  • Backup and restoration
    • Empower administrators with the ability to create and restore backups of user data, providing a safety net for critical information and disaster recovery scenarios
  • User white-listing
    • Enhance security by easily white-listing specific users, ensuring that only selected individuals or groups have access to our systems
  • Real-time notifications
    • Stay in the loop with instant notifications when a new base or product user is created/updated/removed or when attributes are modified, allowing for timely response and action
  • Time-to-live (TTL) configuration
    • Efficiently manage user data housekeeping by automatically removing outdated information based on customizable time-to-live (TTL) settings
  • CRUD operations on users and groups
    • Take control of user and group management with the ability to perform Create, Read, Update, and Delete (CRUD) operations effortlessly
  • GDPR and company-wide compliance
    • Services are identifying and exchanging sensitive user information only via internal user id hash
    • Ensuring every event or runtime data are stripped from sensitive data prior logging

Authentication variants

  • MagicLink web & mobile authentication
  • Authentication for machine users
  • Federated user authentication with OIDC

Additional Content