Component Flow Diagram — customer identity, Manulife Canada

Component Flow Diagram — customer identity, Manulife Canada An architecture diagram generated by Archify. Customer · 3,309,891 logins / month · Architecture component · monthly OIDC SSO · lower bound Customer 3,309,891 logins / month monthly OIDC SSO · lower bound Web clients · 11 OIDC client IDs · Architecture component · 1,435,783 / mo · 43.4% Web clients 11 OIDC client IDs 1,435,783 / mo · 43.4% Mobile apps · 3 OIDC client IDs · Architecture component · 1,874,108 / mo · 56.6% Mobile apps 3 OIDC client IDs 1,874,108 / mo · 56.6% IAM Gateway · /authorize · /token · /userinfo · Manulife ID · ForgeRock CIAM · ext-cdt-cet-iam-gateway-prod IAM Gateway /authorize · /token · /userinfo ext-cdt-cet-iam-gateway-prod Mobile OAuth stack · Separate from web · Manulife ID · ForgeRock CIAM · ext-cdt-cet-mobile-can-oauth-prod Mobile OAuth stack Separate from web ext-cdt-cet-mobile-can-oauth-prod ForgeRock CIAM · Manulife ID · idm-api · Manulife ID · ForgeRock CIAM · source of truth · no change in MVP ForgeRock CIAM Manulife ID · idm-api source of truth · no change in MVP Product portals · 9 secure portals · 5 mobile apps · Architecture component · own authorization · own session Product portals 9 secure portals · 5 mobile apps own authorization · own session di-dashboard-services · Fastify BFF · di-dashboard MFE · Architecture component · DEV only di-dashboard-services Fastify BFF · di-dashboard MFE DEV only Entitlements platform · ent-api {adv · cp · gb} · Architecture component · policy sets · in PROD Entitlements platform ent-api {adv · cp · gb} policy sets · in PROD BU Data APIs · per-business-unit domains · Architecture component · gb-core-authx exchange not wired BU Data APIs per-business-unit domains gb-core-authx exchange not wired BU Mapping Service · id.manulife.ca/mappings · Architecture component · manually maintained · in PROD BU Mapping Service id.manulife.ca/mappings manually maintained · in PROD Login request · 1,435,783 / mo Login request · 1,874,108 / mo OAuth redirects · PKCE OAuth · second stack Issues ID + access token Same directory Redirects authenticated users Check session · get token OIDC + PKCE · DEV POST /entitled POST /mappings/search Service principal · ?ciamId= Manulife ID · ForgeRock CIAM Legend Frontend Security External

Reconstructed, not client-authored

  • • Konrad, from the API inventory + CIAM telemetry
  • • Not validated — see open question 33

Current state · fourteen front doors

  • • Web — 1,435,783 · 11 clients (43.4%)
  • • Mobile — 1,874,108 · 3 clients (56.6%)

What the picture shows

  • • Authentication is unified; nothing after it is
  • • Entitlements in PROD, off the dashboard path — R1.2
  • • No customer claim crosses the fan-out — R1.1