SaFi Bank Space : IAM Overall Design Diagram

Notes

SaFi App will generate the PKI signature by VIDA SDK and put it into the request header. For more details can refer to VIDA PKI.
Cloudflare WAF filters out all requests not possessing the PKI signature header safi-sign (except for some endpoints on the allow list - see the 3rd party flow below).
PKI info will be sent along the way down to the IAM lib in the domain manager.
The PKI key registration / signature flow is similar to WebAuthn (but currently VIDA proprietary), refer to IAM for Native Apps for more context.

Notes

Cloudflare WAF rules allow access to endpoints on the allow list (Exposed Endpoints & Tyk Mappings)
3rd party request’s authentication is handled by
1. Tyk via either static auth token or openKeyless (can refer to https://tyk-dash.tyk.dev.safibank.online/keys to check the current keys),
2. domain manager (HMAC, any other 3rd party specific),
3. PROPOSAL: IAM lib should handle these (at least the common ones).
Plan to have mTLS. (TBD)

Notes

BOFE will connect to backoffice-manager directly and send all the request to it. Note that BOFE does not access any other service directly.
BOFE request will not go through Tyk gateway but will connect through Cloudflare WARP VPN and then go through Traefik ingress to reach the backoffice-manager.
JWT will be used to do authentication & authorization.
Can refer to IAM for Back Office (Technical) for context about how Okta and OAuth2/OIDC is used.

Notes

Developers can freely access services through Cloudflare WARP VPN (authenticated as service call for the domain manager).

This is not enabled currently (neither in dev nor in epfs)

Notes

When we do service to service call (like in the above diagram, service A call service B), we will use XFCC header to authenticate the request and it will be handled inside IAM lib.

Attachments: