SaFi Bank Space : IAM for Native Apps

Created by Norbert Bérci (Unlicensed), last modified on Dec 13, 2022

Overview

Notes

SaFi App will generate the PKI signature by VIDA SDK and put it into the request header. For more details can refer to VIDA PKI.
Cloudflare WAF filters out all requests not possessing the PKI signature header safi-sign (except for some endpoints on the allow list - see the 3rd party flow below).
PKI info will be sent along the way down to the IAM lib in the domain manager.
The PKI key registration / signature flow is similar to WebAuthn (but currently VIDA proprietary), refer to IAM for Native Apps for more context.

Detailed Overview

Thoughts on signing requests

Architecture

Notes

For IAM manager API, see its swagger UI (Brave)
For VIDA API, see VIDA API
For Kafka messages, see IAM Audit Logs (WIP)

Data Relationship

Notes

Only a single credential can be in IN_PROGRESS state for each customer.

State Transition Diagram

Archieve

Project Portunus (IAM PKI PoC)

Detailed Designs

VIDA PKI

https://safibank.atlassian.net/wiki/spaces/ITArch/pages/70484094/Register+passcode#Technical-Assessment

https://safibank.atlassian.net/wiki/spaces/ITArch/pages/71434533/Authorize+an+action#Technical-Assessment

https://safibank.atlassian.net/wiki/spaces/ITArch/pages/71762598/Authorize+with+face+matching+Step+up#Technical-Assessment

https://safibank.atlassian.net/wiki/spaces/ITArch/pages/71959202/Offboard+user+-+deny+login#Technical-Assessment

Ably and IAM

https://github.com/SafiBank/SaFiMono/tree/main/common/iam-auth-lib

Attachments:

Screenshot 2022-05-09 at 16.31.36.png (image/png)

Screenshot 2022-05-14 at 5.25.41.png (image/png)

image-20220530-055401.png (image/png)

~drawio~6203b4b4e5caff0070e2aa9c~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)

plantuml_1653963813109 (text/plain)

plantuml_1653963813109.svg (image/svg+xml)

plantuml_1653963813109.png (image/png)

plantuml_1653964312771.svg (image/svg+xml)

plantuml_1653964312771 (text/plain)

plantuml_1653964312771.png (image/png)

plantuml_1653964312771 (text/plain)

plantuml_1653964312771.svg (image/svg+xml)

plantuml_1653964312771.png (image/png)

plantuml_1653963813109 (text/plain)

plantuml_1653963813109.svg (image/svg+xml)

plantuml_1653963813109.png (image/png)

plantuml_1653963813109 (text/plain)

plantuml_1653963813109.svg (image/svg+xml)

plantuml_1653963813109.png (image/png)

plantuml_1653964312771 (text/plain)

plantuml_1653964312771.svg (image/svg+xml)

plantuml_1653964312771.png (image/png)

plantuml_1653964312771 (text/plain)

plantuml_1653964312771.svg (image/svg+xml)

plantuml_1653964312771.png (image/png)

plantuml_1653963813109 (text/plain)

plantuml_1653963813109.svg (image/svg+xml)

plantuml_1653963813109.png (image/png)

plantuml_1653971717234 (text/plain)

plantuml_1653971717234.svg (image/svg+xml)

plantuml_1653971717234.png (image/png)

plantuml_1653971717234 (text/plain)

plantuml_1653971717234.svg (image/svg+xml)

plantuml_1653971717234.png (image/png)

plantuml_1653972474535 (text/plain)

plantuml_1653972474535.svg (image/svg+xml)

plantuml_1653972474535.png (image/png)

~drawio~6203b4b4e5caff0070e2aa9c~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)

Untitled Diagram.drawio (application/vnd.jgraph.mxfile)

Untitled Diagram.drawio.png (image/png)

plantuml_1653964312771 (text/plain)

plantuml_1653964312771.svg (image/svg+xml)

plantuml_1653964312771.png (image/png)

plantuml_1653964312771 (text/plain)

plantuml_1653964312771.svg (image/svg+xml)

plantuml_1653964312771.png (image/png)

plantuml_1653972474535.svg (image/svg+xml)

plantuml_1653972474535 (text/plain)

plantuml_1653972474535.png (image/png)

plantuml_1653972474535 (text/plain)

plantuml_1653972474535.svg (image/svg+xml)

plantuml_1653972474535.png (image/png)

plantuml_1653964312771 (text/plain)

plantuml_1653964312771.svg (image/svg+xml)

plantuml_1653964312771.png (image/png)

plantuml_1653964312771 (text/plain)

plantuml_1653964312771.svg (image/svg+xml)

plantuml_1653964312771.png (image/png)

plantuml_1653964312771 (text/plain)

plantuml_1653964312771.svg (image/svg+xml)

plantuml_1653964312771.png (image/png)

plantuml_1653972474535 (text/plain)

plantuml_1653972474535.svg (image/svg+xml)

plantuml_1653972474535.png (image/png)

plantuml_1653963813109 (text/plain)

plantuml_1653963813109.svg (image/svg+xml)

plantuml_1653963813109.png (image/png)

plantuml_1653963813109 (text/plain)

plantuml_1653963813109.svg (image/svg+xml)

plantuml_1653963813109.png (image/png)

plantuml_1653963813109 (text/plain)

plantuml_1653963813109.svg (image/svg+xml)

plantuml_1653963813109.png (image/png)

plantuml_1653963813109 (text/plain)

plantuml_1653963813109.svg (image/svg+xml)

plantuml_1653963813109.png (image/png)

plantuml_1653971717234.svg (image/svg+xml)

plantuml_1653971717234 (text/plain)

plantuml_1653971717234.png (image/png)

plantuml_1653964312771.svg (image/svg+xml)

plantuml_1653964312771 (text/plain)

plantuml_1653964312771.png (image/png)

plantuml_1653972474535.svg (image/svg+xml)

plantuml_1653972474535 (text/plain)

plantuml_1653972474535.png (image/png)

plantuml_1653964312771 (text/plain)

plantuml_1653964312771.svg (image/svg+xml)

plantuml_1653964312771.png (image/png)

~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)

Untitled Diagram.drawio (application/vnd.jgraph.mxfile)

Untitled Diagram.drawio.png (image/png)

~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)

Untitled Diagram.drawio (application/vnd.jgraph.mxfile)

Untitled Diagram.drawio.png (image/png)

~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)

Untitled Diagram.drawio (application/vnd.jgraph.mxfile)

Untitled Diagram.drawio.png (image/png)

~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)

Untitled Diagram.drawio (application/vnd.jgraph.mxfile)

Untitled Diagram.drawio.png (image/png)

~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)

PKI plus access token.drawio (application/vnd.jgraph.mxfile)

PKI plus access token.drawio.png (image/png)

Untitled Diagram.drawio (application/vnd.jgraph.mxfile)

Untitled Diagram.drawio.png (image/png)

~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)

Untitled Diagram.drawio (application/vnd.jgraph.mxfile)

Untitled Diagram.drawio.png (image/png)

~PKI plus access token.drawio.tmp (application/vnd.jgraph.mxfile)

PKI plus access token.drawio (application/vnd.jgraph.mxfile)

PKI plus access token.drawio.png (image/png)

~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)

Untitled Diagram.drawio (application/vnd.jgraph.mxfile)

Untitled Diagram.drawio.png (image/png)

~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)

Untitled Diagram.drawio (application/vnd.jgraph.mxfile)

Untitled Diagram.drawio.png (image/png)

~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)

Untitled Diagram.drawio (application/vnd.jgraph.mxfile)

Untitled Diagram.drawio.png (image/png)

~drawio~6203b4b4e5caff0070e2aa9c~Auth with PKI and perimeter check.drawio.tmp (application/vnd.jgraph.mxfile)

Auth with PKI and perimeter check.drawio (application/vnd.jgraph.mxfile)

Auth with PKI and perimeter check.drawio.png (image/png)

~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)

Untitled Diagram.drawio (application/vnd.jgraph.mxfile)

Untitled Diagram.drawio.png (image/png)

~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)

Untitled Diagram.drawio (application/vnd.jgraph.mxfile)

Untitled Diagram.drawio.png (image/png)

~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)

Untitled Diagram.drawio (application/vnd.jgraph.mxfile)

Untitled Diagram.drawio.png (image/png)

~Auth with PKI and perimeter check.drawio.tmp (application/vnd.jgraph.mxfile)

Auth with PKI and perimeter check.drawio (application/vnd.jgraph.mxfile)

Auth with PKI and perimeter check.drawio.png (image/png)

2-Registration.svg (image/svg+xml)

3-Login.svg (image/svg+xml)

2-Registration.svg (image/svg+xml)

Screenshot 2022-06-08 at 22.20.16.png (image/png)

Screenshot 2022-06-08 at 22.20.31.png (image/png)

~PKI plus access token.drawio.tmp (application/vnd.jgraph.mxfile)

PKI plus access token.drawio (application/vnd.jgraph.mxfile)

PKI plus access token.drawio.png (image/png)

~PKI plus access token.drawio.tmp (application/vnd.jgraph.mxfile)

PKI plus access token.drawio (application/vnd.jgraph.mxfile)

PKI plus access token.drawio.png (image/png)

~PKI plus access token.drawio.tmp (application/vnd.jgraph.mxfile)

PKI plus access token.drawio (application/vnd.jgraph.mxfile)

PKI plus access token.drawio.png (image/png)

~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)

Untitled Diagram.drawio (application/vnd.jgraph.mxfile)

Untitled Diagram.drawio.png (image/png)

~Auth with PKI and perimeter check.drawio.tmp (application/vnd.jgraph.mxfile)

PoC flow.drawio (application/vnd.jgraph.mxfile)

PoC flow.drawio.png (image/png)

~PoC flow.drawio.tmp (application/vnd.jgraph.mxfile)

PoC flow.drawio (application/vnd.jgraph.mxfile)

PoC flow.drawio.png (image/png)

~Untitled Diagram.drawio.tmp (application/vnd.jgraph.mxfile)

Untitled Diagram.drawio (application/vnd.jgraph.mxfile)

Untitled Diagram.drawio.png (image/png)

~drawio~6203b4b4e5caff0070e2aa9c~IAM manager arch.drawio.tmp (application/vnd.jgraph.mxfile)

IAM manager arch.drawio (application/vnd.jgraph.mxfile)

IAM manager arch.drawio.png (image/png)

~drawio~6203b4b4e5caff0070e2aa9c~IAM data relationship.drawio.tmp (application/vnd.jgraph.mxfile)

IAM data relationship.drawio (application/vnd.jgraph.mxfile)

IAM data relationship.drawio.png (image/png)

IAM credential state transition.drawio (application/vnd.jgraph.mxfile)

IAM credential state transition.drawio.png (image/png)

~IAM data relationship.drawio.tmp (application/vnd.jgraph.mxfile)

IAM data relationship.drawio (application/vnd.jgraph.mxfile)

IAM data relationship.drawio.png (image/png)