Architect identity lifecycle, authentication, authorization and accounting
Domain 7 tests end-to-end identity architecture: from authoritative source to deprovisioning, and from authentication assurance to authorization decisions and audit.
Lifecycle
Use one authoritative source (usually HR) for workforce identity; provision via SCIM; automate joiner-mover-leaver; reconcile to detect orphans; run periodic entitlement reviews and separation-of-duties analysis at role design. Contractors and service accounts need owners and expiry. Zero standing privilege and just-in-time elevation reduce exposure.
Authentication
NIST SP 800-63B defines AAL1-3. Prefer phishing-resistant authenticators (FIDO2/WebAuthn) for administrators; SMS and knowledge-based answers are discouraged. Federation uses SAML 2.0 or OIDC on top of OAuth 2.0; keep token lifetimes short, bind refresh tokens, and protect the redirect flow with PKCE. Risk-based step-up authentication adapts assurance to context.
Authorization and accounting
Models: DAC, MAC, RBAC (role explosion is the known failure), ABAC on attributes, ReBAC for relationships, and policy-as-code (XACML, OPA) for consistent enforcement. Enforce authorization at the policy enforcement point, not the UI. PAM provides vaulting, session recording, and approval workflows for privileged access. Accounting means logging authentication and authorization decisions with sufficient context, protected from tampering, and correlated in the SIEM for non-repudiation.
Worked example
Two companies merge. The architect designates one HR system as authoritative, provisions SaaS access via SCIM, federates through a central IdP using SAML, maps job codes to RBAC roles, adds ABAC region rules for data residency, and gives administrators just-in-time PAM sessions. Deprovisioning must complete within one hour of a termination event. Reasoning: a single source prevents orphan accounts, SoD analysis at role design prevents toxic combinations, and WebAuthn for administrators supports phishing-resistant assurance at AAL3.
Traps
Confusing authentication with authorization; unchecked role explosion; shared or unowned service accounts; slow contractor deprovisioning; SMS MFA for high assurance; long-lived tokens; rubber-stamped access reviews; no privileged session logging.