Skip to main content

Identity–Platform Integration

Summary​

Identity owns users, authentication, tokens, roles, permissions, sessions, and an Identity-owned tenant snapshot. Platform owns canonical control-plane tenant metadata and tenant provisioning. A complete automatic synchronization path between the two is not confirmed.

Audience​

  • Platform administrators and implementation partners
  • Development, QA, DevOps, architecture, and security teams

Purpose​

This boundary prevents Platform provisioning records from being mistaken for Identity accounts and prevents Identity claims from being treated as the canonical platform tenant record.

Architecture​

Business concepts​

  • Identity tenant snapshot — Implemented foundation: Identity has tenant identity/status metadata that can be used during tenant-context validation when populated.
  • Tenant claims/context — Implemented: authenticated context can carry tenant identifiers for tenant users; platform users are modeled separately.
  • Platform administration authorization — Implemented: Platform endpoint groups apply authenticated platform-administration checks. Exact role-check mechanics are intentionally excluded.
  • Gateway interaction — Implemented / Transitional: the Gateway routes authentication and platform traffic during incremental service extraction.
  • Admin bootstrap — Foundation: Platform records a login-pending administrator request and emits a lifecycle event; it explicitly does not create fake credentials or an Identity user.
  • Automatic synchronization — Requires confirmation: reviewed source does not confirm an end-to-end consumer that creates the Identity account or maintains the Identity tenant snapshot from Platform events.

Technical implementation​

Platform validation and provisioning use Platform-owned tenant identifiers. Identity login validates its own tenant snapshot where available and emits tenant context in authentication results/claims. Consumers must preserve identifier semantics and should fail safely when tenant context is absent or inconsistent.

Source References​

  • microservices/src/identity-service/Domain/Entities/IdentityTenantSnapshot.cs
  • microservices/src/identity-service/Data/IdentityDbContext.cs
  • microservices/src/identity-service/Application/Auth/IdentityAuthService.cs
  • microservices/src/platform-service/Application/TenantProvisioningOrchestrator.cs
  • microservices/src/platform-service/Api/PlatformTenantOnboardingEndpoints.cs
  • microservices/src/platform-service/Messaging/PlatformEventConsumer.cs
  • microservices/src/gateway-api/Program.cs

See Also​

Keywords​

  • Identity ownership
  • Platform ownership
  • Tenant context
  • Admin bootstrap

Revision Information​

  • Status: Draft
  • Last reviewed: 2026-07-14
  • Review cycle: Quarterly