Component Flow Diagram — customer identity, Manulife Canada

Component Flow Diagram — customer identity, Manulife Canada An architecture diagram generated by Archify. Customer · 3,309,891 logins / month · Architecture component · one identity, one session Customer 3,309,891 logins / month one identity, one session Web clients · 11 OIDC client IDs · Architecture component · 1,435,783 / mo · 43.4% Web clients 11 OIDC client IDs 1,435,783 / mo · 43.4% Mobile apps · 3 OIDC client IDs · Architecture component · 1,874,108 / mo · 56.6% Mobile apps 3 OIDC client IDs 1,874,108 / mo · 56.6% ForgeRock CIAM · Manulife ID · unchanged · Manulife ID · ForgeRock CIAM · one session across channels ForgeRock CIAM Manulife ID · unchanged one session across channels IAM Gateway · One stack, both channels · Manulife ID · ForgeRock CIAM · ext-cdt-cet-iam-gateway-prod IAM Gateway One stack, both channels ext-cdt-cet-iam-gateway-prod Product portals · Servicing and transactions · Architecture component · own OIDC client + application session Product portals Servicing and transactions own OIDC client + application session Unified Portal · Shell + experience API · Architecture component · channel-agnostic — R3.1 Unified Portal Shell + experience API channel-agnostic — R3.1 BU Mapping Service · Navigation only · which tiles · Architecture component · demoted — no longer a disclosure control BU Mapping Service Navigation only · which tiles demoted — no longer a disclosure control Entitlement decision · POST /entitled · see / act · Architecture component · already in PROD · ent-api Entitlement decision POST /entitled · see / act already in PROD · ent-api Token exchange · gb-core-authx · RFC 8693 · Architecture component · protected aggregation path Token exchange gb-core-authx · RFC 8693 protected aggregation path BU Data APIs · Enforce per-customer authz · Architecture component · customer subject in token BU Data APIs Enforce per-customer authz customer subject in token Login request · 1,435,783 / mo Login request · 1,874,108 / mo OAuth redirects · PKCE Audience-bound OAuth tokens Issues ID + access token OIDC code + PKCE · CIAM SSO One session, all channels POST /entitled May this ID see this BU? Which tiles to offer Protected data: RFC 8693 Customer-scoped token Manulife ID · ForgeRock CIAM Legend Frontend Backend Security External

Konrad target state · not client-authored

  • • Argued in R1.1 and R1.2, not agreed
  • • Open questions 17 and 33 decide it

One CIAM session, audience-bound access

  • • One CIAM browser session; audience-bound tokens
  • • Entitlement is a decision, not a table — R1.2
  • • BU apps run their own OIDC flow — R1.1

Unchanged on purpose

  • • ForgeRock still authenticates — no new identity surface
  • • BU apps still own sessions, servicing and transactions
  • • Manual linking untouched; BU Mapping is navigation