Customer identity abstraction layer

As explained in Effective Platform Engineering

A customer identity abstraction layer is an intermediary that decouples platform-user identities and permissions from the identities of underlying infrastructure resources.

A customer identity abstraction layer decouples platform-user identities and permissions from underlying infrastructure identities. It lets a platform provide flexible, self-service access without mapping every person directly to servers, storage, and other resources. section 4.3.3

The pattern addresses recurring identity and authorization problems:

• Avoids brittle one-to-one mappings between platform users and infrastructure resources. section 4.3.3
• Centers authorization on development teams while individuals remain the authenticating subjects. section 4.3.3
• Uses the identity provider as a go-between rather than the sole source of truth, allowing authorization results to be customized. section 4.3.3

Platform integration scenario

A platform may centralize access across SaaS products while an integration orchestrator maintains team information and publishes events for downstream integrations. Developers receive the resulting access through a product-like workflow instead of discovering infrastructure resources and completing manual requests themselves. section 4.3.3

Figure 4.8 We want the IDP to be the go-between rather than the source of truth, and we will need to be able to customize the results from the authorization service.

Use the architecture figure to inspect the identity provider’s intermediary role and the need to customize authorization-service results. section 4.3.3

How Effective Platform Engineering covers it

How deep it goes

Explains the abstraction’s rationale, team authorization model, and identity-provider role, while stopping short of implementation detail.

Examples

Uses SaaS products, GitHub, servers, storage, downstream integrations, and developers’ manual access requests as examples.

What it assumes

Assumes familiarity with authentication, authorization, SaaS access controls, and engineering-platform integrations.

What you can do after

Evaluate identity architectures for flexibility by separating platform customers from underlying infrastructure identities.

How it connects

Connects authentication, authorization, identity providers, integration orchestration, event-driven architecture, and team-based access control.

liveBookmanning.com

Read Effective Platform Engineering on liveBook Get the book at manning.com

Related concepts

• identity provideruses · An identity provider is a system that authenticates users or other entities and supplies identity information or authentication assertions to relying applications and services.

This explainer was generated by Manning's knowledge graph from the text of Effective Platform Engineering. The section links point to the parts of the book it draws on.