OnePortal IAM — Authorization Server
The challenge
Unify identity, SSO, and authorization for multiple government entities while preserving strict tenant isolation.
The architecture
Designed a multi-tenant OAuth 2.0 / OIDC authority with PKCE, Client Credentials, and On-Behalf-Of flows, tenant-aware RBAC scopes, and federation to UAE PASS + Azure Entra ID.
What I did
-
Defined multi-tenant OAuth 2.0/OIDC flows (Authorization Code, Client Credentials, PKCE, On-Behalf-Of), token issuance strategy, and secure API protection patterns adopted across all SDD services.
-
Established UAE PASS and Azure Entra ID SSO federation design — identity propagation contracts, trust boundaries, and integration standards for consuming applications.
-
Authored tenant-aware RBAC architectural guidelines with fine-grained scope definitions; structured code reviews to ensure implementation fidelity and enforce security standards.
-
Guided team on threat modelling, secure coding practices, and OAuth edge-case handling; reviewed pull requests and provided actionable, standards-aligned feedback.
The impact
Standardized secure token and scope contracts across SDD platforms, reduced integration ambiguity for teams, and strengthened security posture for cross-entity services.
Technologies
- .NET 8
- ASP.NET Core
- OAuth 2.0 / OIDC
- Azure Entra ID
- UAE PASS