ARCHITECTURE DELTA · AUTHORED SNAPSHOTS

See what changed
before you merge.

Component Flow Diagram — customer identity, Manulife Canada → Component Flow Diagram — customer identity, Manulife Canada

4ADDED
4REMOVED
13CHANGED
+ ADD− DEL~ MOD↔ MOVE
Component Flow Diagram — customer identity, Manulife Canada An architecture diagram generated by Archify. Redirects authenticated users Service principal · ?ciamId= POST /mappings/search Issues ID + access token OAuth · second stack Same directory Check session · get token OAuth redirects · PKCE Manulife ID · ForgeRock CIAM BU Data APIs · per-business-unit domains · Architecture component · gb-core-authx exchange not wired BU Data APIs per-business-unit domains gb-core-authx exchange not wired ForgeRock CIAM · Manulife ID · idm-api · Manulife ID · ForgeRock CIAM · source of truth · no change in MVP ForgeRock CIAM Manulife ID · idm-api source of truth · no change in MVP di-dashboard-services · Fastify BFF · di-dashboard MFE · Architecture component · DEV only di-dashboard-services Fastify BFF · di-dashboard MFE DEV only IAM Gateway · /authorize · /token · /userinfo · Manulife ID · ForgeRock CIAM · ext-cdt-cet-iam-gateway-prod IAM Gateway /authorize · /token · /userinfo ext-cdt-cet-iam-gateway-prod BU Mapping Service · id.manulife.ca/mappings · Architecture component · manually maintained · in PROD BU Mapping Service id.manulife.ca/mappings manually maintained · in PROD Mobile OAuth stack · Separate from web · Manulife ID · ForgeRock CIAM · ext-cdt-cet-mobile-can-oauth-prod Mobile OAuth stack Separate from web ext-cdt-cet-mobile-can-oauth-prod Product portals · 9 secure portals · 5 mobile apps · Architecture component · own authorization · own session Product portals 9 secure portals · 5 mobile apps own authorization · own session BU Data APIs · Enforce per-customer authz · Architecture component · customer subject in token BU Data APIs Enforce per-customer authz customer subject in token ForgeRock CIAM · Manulife ID · unchanged · Manulife ID · ForgeRock CIAM · one session across channels ForgeRock CIAM Manulife ID · unchanged one session across channels Customer · 3,309,891 logins / month · Architecture component · one identity, one session Customer 3,309,891 logins / month one identity, one session Unified Portal · Shell + experience API · Architecture component · channel-agnostic — R3.1 Unified Portal Shell + experience API channel-agnostic — R3.1 Entitlement decision · POST /entitled · see / act · Architecture component · already in PROD · ent-api Entitlement decision POST /entitled · see / act already in PROD · ent-api IAM Gateway · One stack, both channels · Manulife ID · ForgeRock CIAM · ext-cdt-cet-iam-gateway-prod IAM Gateway One stack, both channels ext-cdt-cet-iam-gateway-prod BU Mapping Service · Navigation only · which tiles · Architecture component · demoted — no longer a disclosure control BU Mapping Service Navigation only · which tiles demoted — no longer a disclosure control Mobile apps · 3 OIDC client IDs · Architecture component · 1,874,108 / mo · 56.6% Mobile apps 3 OIDC client IDs 1,874,108 / mo · 56.6% Product portals · Servicing and transactions · Architecture component · own OIDC client + application session Product portals Servicing and transactions own OIDC client + application session Token exchange · gb-core-authx · RFC 8693 · Architecture component · protected aggregation path Token exchange gb-core-authx · RFC 8693 protected aggregation path Web clients · 11 OIDC client IDs · Architecture component · 1,435,783 / mo · 43.4% Web clients 11 OIDC client IDs 1,435,783 / mo · 43.4% One session, all channels OIDC code + PKCE · CIAM SSO Login request · 1,874,108 / mo Login request · 1,435,783 / mo May this ID see this BU? Which tiles to offer Protected data: RFC 8693 Issues ID + access token Audience-bound OAuth tokens POST /entitled Customer-scoped token OAuth redirects · PKCE Manulife ID · ForgeRock CIAM Legend Frontend Backend Security External
Exact authored changes · 23