The objective is to separate identity from implementation.
Every component within the architecture should have a single responsibility.
No single vendor should own my identity.
Replacing any individual component should require little or no change to the rest of the system.
The diagram shows responsibility and separation of concerns rather than process flow. Responsibilities are stable. Current implementations can change without affecting the rest of the architecture.
- I own my domain.
- My domain is my identity.
- Authentication should use open standards wherever possible.
- Passwords should disappear over time.
- Hardware-backed authentication is preferred.
- Every online service should have its own unique identity.
- Recovery should always be possible.
- Simplicity is preferred over unnecessary complexity.
The architecture is divided into layers.
Each layer has a single responsibility.
The architecture has been agreed.
Implementation has not yet begun.
Individual components will be documented as they are implemented.
Each component will be documented in detail over time. Status: 🟢 Documented, 🟡 Planned, ⚪ Not Started.
Every important architectural decision is recorded here with an ID so that future pages can reference it.