Catalog
concept#Security#Architecture#Integration#Platform

Identity and Access Management (IAM)

IAM describes concepts and practices for managing digital identities, authentication and access control across systems.

Identity and Access Management (IAM) is a conceptual framework for centralized management of digital identities, authentication and access controls.
Established
High

Classification

  • High
  • Technical
  • Architectural
  • Advanced

Technical context

Active Directory / LDAPIdentity providers via OIDC/SAML (e.g. Azure AD, Keycloak)Cloud IAM services (e.g. AWS IAM)

Principles & goals

Least privilege: Users and systems receive minimal required rights.Centralized authentication and authorization for consistency.Auditability: All relevant access events must be logged.
Build
Enterprise, Domain, Team

Use cases & scenarios

Compromises

  • Single point of failure if IAM lacks sufficient redundancy.
  • Misconfigured policies lead to over-privilege.
  • Data and privacy risks with inadequately protected identity stores.
  • Enforce least privilege and time-limited permissions.
  • Automated provisioning and deprovisioning from linked sources.
  • Regular access reviews and role adjustments through reviews.

I/O & resources

  • Directory service data (LDAP/AD)
  • Application and role model
  • Authentication and authorization protocols
  • Provisioned user accounts and assigned permissions
  • Audit and compliance reports
  • SSO and token management for applications

Description

Identity and Access Management (IAM) is a conceptual framework for centralized management of digital identities, authentication and access controls. It defines processes, roles, policies and technical mechanisms for provisioning, single sign-on, authorization and auditing to ensure security and compliance across distributed IT landscapes.

✔

  • Improved security through centralized policies and control.
  • Increased efficiency in provisioning and onboarding.
  • Better traceability and compliance capability.

✖

  • High implementation effort with heterogeneous legacy systems.
  • Dependence on correct role and policy modeling.
  • Operational complexity due to token/session management.

  • Time to provision (Provisioning Time)

    Average time from HR trigger to full account and rights assignment.

  • Failed login attempts per user

    Number of failed authentication attempts in a time window to detect attacks.

  • Privileged access review frequency

    Interval at which privileged accounts are reviewed and attested.

Keycloak as enterprise identity provider

Open-source deployment with OIDC/SAML support, SSO and user directory integration.

AWS IAM for cloud resource control

Fine-grained access to cloud resources using roles, policies and temporary credentials.

Enterprise SSO rollout with Azure AD

Centralized identity management and SSO integration for SaaS apps and internal systems.

1

Analyze existing identity sources and applications.

2

Define roles, policies and governance processes.

3

Select and configure an IAM platform including integrations.

4

Test, roll out and establish operations and audit processes.

⚠️ Technical debt & bottlenecks

  • Hard-coded permission logic in apps instead of central policies.
  • Outdated directory protocols without modern provisioning API.
  • Insufficient automation for deprovisioning processes.
legacy-system-integrationorganizational-alignmentcomplex-role-model
  • Assigning admin rights as a default productivity role.
  • Storing credentials in unencrypted systems.
  • Ignoring audit logs for security-relevant events.
  • Underestimating integration effort with legacy systems.
  • Missing redundancy and backup strategies for IAM core components.
  • Complex role models without documented decision rules.
Knowledge of authentication protocols (OIDC, SAML)Experience with directory services and provisioningSecurity architecture and policy design
Confidentiality and integrity of user accountsScalability for growing user numbersInteroperability with existing directories and protocols
  • • Existing legacy directories with limited API support.
  • • Regulatory requirements for privacy and log retention.
  • • Limited operations and monitoring resources in small teams.