Skip to content

Identity & Access Platform

This page describes the ConnectSoft Identity & Access Platform - a production-ready identity, access, and federation platform for multi-tenant SaaS. It is written for product managers, architects, and teams evaluating identity solutions.

The Identity Platform is not a single monolithic service. It is a governed platform composition that separates token issuance, user identity, API perimeter protection, frontend session experience, and backend resource authorization.

Tip

The Identity Platform is built by the Factory and serves as a reference implementation of our microservice template patterns. Customers can use it directly or generate custom identity services using the Factory.

What This Platform Does

The Identity Platform provides:

  • Authorization Server - OpenID Connect / OAuth2 clients, scopes, consent, token issuance, signing keys, and token lifecycle.
  • Identity Backend - Users, profiles, credentials, roles, claims, MFA state, recovery, federation links, and account lifecycle.
  • API Gateway Integration - Public API perimeter, token validation, route authorization, throttling, CORS, and safe user/tenant context propagation.
  • Frontend Integration - Blazor Shell and microfrontends use authorization code with PKCE or a BFF-style integration pattern; browser clients do not invent custom token protocols.
  • Backend Resource Protection - Microservices validate bearer tokens, enforce scopes/roles/policies, and treat forwarded headers as gateway-provided context, not browser trust.
  • External Identity Provider Federation - Google, Facebook, Entra ID / Active Directory, Keycloak, SAML/OIDC providers, and LDAP-backed enterprise directories through approved federation adapters.

Responsibility Model

Component Owns Does Not Own
Authorization Server OAuth/OIDC protocol endpoints, clients, scopes, consent, signing keys, token issuance, refresh/revocation policy User profile data, business authorization decisions inside resource APIs
Identity Backend Accounts, credentials, MFA, recovery, user/role/claim data, external account links, tenant identity policy Token signing, gateway routing, frontend session UI
API Gateway External API perimeter, route policy, coarse authorization, rate limits, CORS, correlation and context headers User management, token issuance, domain authorization
Blazor Shell / MFEs Login UX, session awareness, route-level UX authorization, token acquisition through approved client pattern Long-lived secrets, final API authorization, direct database access
Backend APIs Resource-level authorization, tenant isolation, business rules, audit events Login UI, token minting, trusting unauthenticated headers

Core Features

  • OpenID Connect / OAuth2 - Authorization code with PKCE for interactive clients and client credentials for service-to-service calls
  • Multi-Tenancy - Complete tenant isolation with per-tenant user stores and policies
  • User Management - User registration, password reset, email verification, profile management
  • Role-Based Access Control (RBAC) - Roles and permissions scoped to tenants
  • External Identity Providers - Federation with Entra ID / Active Directory, Google, Facebook, Keycloak, GitHub, SAML/OIDC providers, and LDAP-backed directories
  • MFA and Step-Up - MFA enrollment, recovery, admin enforcement, and step-up authentication for privileged operations
  • API Tokens - Short-lived access tokens and governed service credentials for service-to-service authentication
  • Audit Logging - Complete audit trail of authentication and authorization events
  • Edition Management - Feature flags and capabilities based on subscription tier
  • Health Checks - Built-in health endpoints for monitoring and load balancing
  • Observability - Distributed tracing, metrics, and structured logging

Typical Integrations

Blazor Shell and Microfrontends

  • Shell owns the authenticated application frame and session-aware navigation
  • MFEs use shared identity contracts and call APIs through the approved gateway/BFF path
  • Login, logout, register, callback, and session refresh behavior is centralized rather than duplicated per MFE

Microservices

  • Microservices validate access tokens issued by the Authorization Server
  • Resource APIs enforce audience, scope, role, policy, and tenant checks
  • Service-to-service authentication using client credentials flow
  • Gateway-provided user and tenant headers are treated as derived context and are accepted only from trusted internal gateway paths

External Identity Providers

  • Azure AD / Entra ID for enterprise SSO
  • Google Sign-In for B2C scenarios
  • Facebook and social login for consumer scenarios
  • Keycloak or customer-hosted OIDC/SAML providers for enterprise federation
  • Active Directory or LDAP-backed directories through an identity broker or approved federation adapter

API Gateways

  • Token validation at the gateway
  • User context propagation to downstream services
  • Rate limiting and access control

Frontend Applications

  • Web applications using authorization code flow with PKCE
  • Mobile apps using device flow or authorization code flow
  • Browser applications use PKCE or a BFF-style pattern; implicit flow is not a ConnectSoft default

Ideal Use Cases

  • Centralized Auth for SaaS Products - Single identity platform serving multiple SaaS applications
  • B2B Tenant Onboarding - Self-service tenant creation and user management
  • API Authentication - Service-to-service and API access control
  • Federation Hub - Central identity provider connecting to multiple external IdPs
  • Multi-Product Identity - Shared identity across multiple ConnectSoft platforms
  • Gateway-Protected API Ecosystems - Consistent auth across Shell, MFEs, gateway routes, and backend resource APIs
  • Enterprise Identity Federation - Customer SSO through Entra ID, Keycloak, SAML/OIDC, or LDAP-backed directories

SaaS Consumers by Cycle

The Identity Platform is a foundational Core Platform service consumed by all ConnectSoft SaaS products across all cycles.

Cycle 1: AI Factory SaaS

  • AI Factory SaaS uses Identity Platform for tenant onboarding, user management, and API authentication
  • All Factory-generated projects authenticate via Identity Platform
  • Factory console users authenticate through Identity Platform

Cycle 2: Horizontal SaaS

  • Digital Marketing Hub - User authentication for campaign managers and marketers
  • Short Links Platform - User authentication for link creators and administrators
  • Workflow Orchestrator - Service-to-service authentication for workflow execution
  • Headless CMS - User authentication for content editors and administrators
  • CRM / Contacts Hub - User authentication for sales teams and account managers

Cycle 3: AI & First Vertical

  • AI Bot Framework - User authentication for bot interactions and bot administrators
  • AI Marketing Copilot - User authentication integrated with Digital Marketing Hub
  • Digital Forms SaaS - User authentication for form creators, respondents, and approvers
  • Insurance Suite - Multi-tenant user management for insurance workflows, agents, and customers

Cycle 4: Marketplaces & Ecosystem

  • All marketplace products use Identity Platform for user authentication
  • Integration Platform - Service-to-service authentication for connectors and integrations
  • Support & Self-Service Platform - User authentication for support agents and customers
  • Vertical suites (AdTech, HR) - User authentication across all vertical products

Relationship to the Factory

The Identity Platform demonstrates what the Factory can produce:

  • Built by the Factory - The Identity Platform was generated using the Factory's microservice template
  • Reference Implementation - Shows best practices for multi-tenant SaaS, DDD, and event-driven architecture
  • Customizable via Factory - Customers can generate custom identity services with specific requirements
  • Template Source - Identity patterns are available as templates for Factory users

Note

Customers can use the Identity Platform as-is, or use the Factory to generate custom identity services tailored to their specific needs. The Factory includes identity-related templates and patterns.

Technical Source of Truth

This company page is the product and responsibility overview. Detailed contracts, flows, component responsibilities, implementation backlog, and security model live in the ConnectSoft technical documentation: