System Design FAQ: Top Questions

An Identity and Access Management (IAM) system handles authentication (who you are) and authorization (what you can do). It provides secure user identity verification, role-based access control, and auditability.

📋 Functional Requirements

• Support sign-up/sign-in with email/password and OAuth
• Issue and validate secure tokens (JWTs)
• Manage users, groups, roles, and permissions
• Audit login attempts and access changes

📦 Non-Functional Requirements

• Scalable token issuance and validation
• Encrypted token storage and secure secret rotation
• Compliance with standards (e.g., OAuth2, OpenID Connect)

🏗️ Core Components

• Authentication Service: Handles login/signup and multi-factor auth
• Token Service: Issues and validates JWTs or opaque tokens
• User Store: Stores user credentials and metadata
• RBAC Layer: Maps users to roles and permissions
• Audit Logger: Tracks all auth and access events

🔐 JWT Token Example

{
  "alg": "HS256",
  "typ": "JWT"
}.
{
  "sub": "1234567890",
  "email": "user@example.com",
  "roles": ["admin"],
  "exp": 1718171453
}
        

🔐 Auth Flow (OAuth2 + OpenID Connect)

1. User logs in via identity provider (Google, GitHub)
2. Backend exchanges auth code for access + ID token
3. Token attached to API calls in Authorization: Bearer header
4. Resource server verifies token and checks permissions

🧾 Example RBAC Table

CREATE TABLE roles (
  id UUID PRIMARY KEY,
  name TEXT UNIQUE
);

CREATE TABLE permissions (
  id UUID PRIMARY KEY,
  action TEXT,
  resource TEXT
);

CREATE TABLE role_permissions (
  role_id UUID REFERENCES roles(id),
  permission_id UUID REFERENCES permissions(id)
);

CREATE TABLE user_roles (
  user_id UUID,
  role_id UUID
);
        

📁 Directory as Identity Source

• Integrate with LDAP or Active Directory for enterprise SSO
• Provision accounts via SCIM or API

🧪 Secrets & Key Management

• Use HSM or Vault for signing key storage
• Rotate keys periodically
• Store password hashes using bcrypt or argon2

📈 Metrics and Auditing

• Login success/failure rates
• Invalid token usage
• Admin permission change logs

📌 Final Insight

IAM is a mission-critical system requiring secure, auditable, and scalable design. Use token-based authentication, integrate industry standards, and enforce least privilege access with robust role-permission mapping.