عرض عملي: معمارية الهوية في Larkspur من البداية إلى النهاية

خطوة بخطوة

1. Workforce: corporate directory federated to a cloud IdP with MFA; SSO to the back office and cloud console.
2. Customers: a managed CIAM service with social login for web and mobile, using OIDC with PKCE.
3. Partners: supplier portal access through federation where the partner has an IdP, otherwise managed accounts with MFA; partner APIs through OAuth 2.0 client credentials.
4. Workloads: roles with least-privilege policies; no access keys.
5. Planned mistake: a shared "admin" account for the cloud console. Fix: named users with just-in-time admin roles and a monitored break-glass account.
6. Draw the end-to-end diagram and record each protocol choice with its reason.