Skip to main content

​
What is an Identity Router

The Digital Identity Management Identity Router is a software service that intelligently routes authorization requests to an Identity Provider (IdP) for authentication to grant access to protected resources. The router redirects a Relying Party’s (RP) request for user authentication to the correct IdP service based on a user’s association and supplied credentials. Essentially, the router acts as a proxy between your client application (RP) and the IdP service or authorization server with the following types of Identity Providers:
  • External 3rd Party OIDC-based IdPs such as Auth0 or Okta
  • Any proprietary or in-house developed IdP service that supports the OAuth 2.0 protocol and OIDC-based flows
Digital Identity Management supplies sign in pages that allow users to specify their organizational domain or choose a social provider for authentication. Optionally, your organization can build your own UI pages and integrate with the OIDC-compliant APIs supported by the Digital Identity Management Identity Router. Digital Identity Management Identity Router organization and social provider sign in pages

​
Benefits of the Identity Router

The Identity Router enables organizations to streamline authentication, registration, and access for users across multiple IdPs. This feature helps organizations integrate their Relying Party (RP) or client application with multiple OIDC-based IdPs to improve security and provide a seamless user authorization process.
  • Simplifies complex configurations of user-IdP associations and trust relationships with multiple IdPs since the Identity Router interface handles and redirects all requests to the expected IdP service.
  • Process encrypted OAuth 2.0 tokens to resolve a user identity and IdP association, and route the authorization request to the delegated IdP service on behalf of the RP.
  • Support for external OIDC IdP federation with IdP and RP initiated flows enabling 3rd Party OIDC-based or Social IdPs to perform user authentication.
  • Data storage and user identities are maintained separately (per organization) as required by compliance requirements, thereby improving security.

​
Identity Router Flow

The Digital Identity Management IdP Router facilitates communication between a Relying Party and one or more IdP(s) based on an OIDC flow using /authorize and /token end points to complete the process. The RP only needs to know about the standard router interface when sending authorization requests. The Digital Identity Management Identity Router processes and sends the request to the correct IdP based on a user’s resolved IdP associations. At a high level the process of requesting authorization to obtaining the tokens via Identity router is as follows:
  1. A user signs in and requests access to a protected resource(s). The Relying Party (RP) or client application determines that the user requires authorization before access is granted.
  2. The RP or client application initiates a call to the Identity router for authorization.
  3. The Identity router prompts for a username, such as an email or mobile number, and the organization (optional). The Identity router determines the correct IdP based on user input and redirects the request to the target IdP’s /authorize end point to start a standard OIDC flow.
  4. After a successful user authentication completes, the IdP service returns the information back to the RP via the Identity router.
  5. This information retrieved in the previous step is included in the RP’s next request to the Identity Router for tokens. The Identity router resolves the IdP details and redirects the RP’s request to the IdP /token end point.
  6. After a successful validation, the IdP service issues the required tokens and delivers these tokens to the RP via the Identity router.
  7. The user is now authorized and has a token to access the protected resource(s).

​
Supported Identity Providers (IdP)

Digital Identity Management IdP Organizations that don’t have an Identity Provider can integrate with the out-of-the-box Digital Identity Management IdP that manages all ULM users. The Digital Identity Management IdP adheres to the OAuth 2.0 protocol to provide a high level of security and protection of sensitive data such as PII or financial records. See Identity Provider and Single Sign-On for more details. External OIDC Based IdP The Digital Identity Management IdP Router supports the following types of federation:
  • Social federation - the router acts a Relying Party (RP) to the 3rd party IdP to streamline registration and authentication. After a user successfully onboards/authenticates, the user can create a Digital Identity Management profile, and authenticate themselves with the Digital Identity Management IdP instead of the original social IdP.
  • External federation - the router acts as a resource server to the 3rd party IdP allowing users in those external ecosystems to consume Digital Identity Management services and resources. By integrating with Digital Identity Management, federation extends or augments an external IdP’s capabilities and the existing IdP service doesn’t need to be replaced.

​
Key Capabilities

The Digital Identity Management Identity Router manages a RP’s request for authentication and authorization by communicating with an IdP service(s), and can perform the following tasks:
  • Invoke authorization and token requests via REST APIs on behalf of an RP that use the Digital Identity Management IdP Router.
  • Onboard/Sign in and authenticate with users across multiple IdPs including the Digital Identity Management IdP for ULM users.
See the following for more information:
  • View federated users by External User IDs as well as ULM User IDs from the Care Console
Parent topic:Digital Identity Management Features