Skip to main content

Identity Security Best Practices

Summary​

Secure identity operation depends on protecting credentials and tokens, validating JWTs at trusted boundaries, applying least privilege, preserving tenant scope, and monitoring session and security events.

Audience​

  • Platform and customer administrators
  • Implementation and support teams
  • Developers and DevOps engineers
  • Solution architects and security engineers

Purpose​

These public-safe practices explain how to use confirmed identity controls without disclosing sensitive configuration or restricted operational procedures.

Architecture​

Business concepts​

  • Least privilege: assign only the roles and permissions needed for current responsibilities.
  • Tenant integrity: treat tenant identity as authorization context, not a user-selectable data filter.
  • Session accountability: review active devices and revoke sessions that are no longer trusted.
  • Credential confidentiality: never log, publish, or transmit passwords or token material outside approved channels.
  • Defense in depth: validate tokens and enforce access at the downstream owner of each operation.

Technical implementation​

Confirmed implementation controls include BCrypt password hashing, signed JWT validation, hashed refresh-token persistence, refresh rotation, device-session revocation, login audits, security events, correlation identifiers, user status checks, and tenant snapshot validation when available.

Recommended integration and operating practices are:

  • Use protected transport for every portal, gateway, and service request.
  • Keep signing material and other sensitive configuration in approved environment-injection and secret-management systems.
  • Never store passwords, access tokens, or refresh tokens in logs, analytics, URLs, or documentation.
  • Validate accepted token properties in each protected downstream application.
  • Evaluate role or permission claims together with tenant and resource scope.
  • Revoke device sessions after suspected exposure, device loss, or account-role change according to approved procedures.
  • Monitor repeated authentication failures and significant security events through restricted operational tooling.
  • Review role assignments and tenant access periodically.
  • Treat detailed thresholds, key rotation, incident response, and security findings as restricted internal documentation.

Confirmed source references​

  • microservices/src/identity-service/Application/Security/BCryptIdentityPasswordHasher.cs
  • microservices/src/identity-service/Application/Security/IdentityJwtTokenService.cs
  • microservices/src/identity-service/Application/Security/IdentityRefreshTokenService.cs
  • microservices/src/identity-service/Application/Auth/IdentityAuthService.cs
  • microservices/src/identity-service/Domain/Entities/SecurityEvent.cs

See Also​

Keywords​

  • Secure token handling
  • Tenant-aware security
  • Session review

Revision Information​

  • Last reviewed: 2026-07-14
  • Owner: security-team
  • Status: Draft