Security7 min read

Identity & Access Management

Design IAM systems with SSO, RBAC, SCIM provisioning, MFA enforcement, and lifecycle management to control who accesses what.

iamidentityssorbac

Identity and Access Management (IAM) ensures the right people have the right access to the right resources at the right time. It covers authentication (who are you?), authorization (what can you do?), provisioning, and governance.

Centralize identity with an IdP (Okta, Auth0, Entra ID). Enforce MFA universally. Use RBAC with least privilege. Automate provisioning/deprovisioning via SCIM. Audit all access regularly.

Workflow

Centralize authentication with an Identity ProviderFragmented auth (each app manages its own users) creates unmanageable complexity and security gaps.
Design role-based access controlUser-level permission management doesn't scale; roles create manageable abstraction.
Enforce MFA for all usersPassword-only auth is consistently the top breach vector; MFA stops 99.9% of automated attacks.
Automate provisioning and deprovisioning with SCIMManual account creation is slow and manual deprovisioning is often forgotten-a major security risk.
Govern access with reviews and auditsPermission creep occurs silently; regular reviews catch over-provisioned accounts.

Output Format

SSO via IdP for all apps, RBAC enforced at API layer, MFA mandatory, SCIM provisioning automated, quarterly access reviews, audit logs in SIEM.

Examples

RBAC middleware: `const requireRole = (role) => (req, res, next) => req.user.roles.includes(role) ? next() : res.status(403).json({ error: "forbidden" })`

SCIM provisioning: IdP sends PATCH to `/scim/v2/Users/:id` with `{ op: "replace", path: "active", value: false }` on termination → app disables account

OIDC integration: `passport.use(new OidcStrategy({ issuer: "https://company.okta.com", clientID, clientSecret, callbackURL }, (issuer, profile, done) => done(null, profile)))`

Edge Cases & Gotchas

Break-glass accounts: maintain 2-3 emergency admin accounts not tied to SSO, stored in a physical safe, with access audited
Service accounts need their own lifecycle: rotate credentials quarterly, disable when service is decommissioned
Just-in-time provisioning: provision user on first login if SCIM not available, but still deprovision via SCIM or webhook on termination

When to Break These Rules

Single-developer projects or tools with <5 users don't need a full IdP-basic username/password with MFA (e.g., via Supabase Auth) is proportionate.

Reference Files

Okta documentation: https://developer.okta.com/
SCIM 2.0 RFC: https://datatracker.ietf.org/doc/html/rfc7644
NIST Digital Identity Guidelines SP 800-63: https://pages.nist.gov/800-63-3/
Auth0 IAM guide: https://auth0.com/docs/manage-users