Digital Identity

Using a Reference Architecture

Small organizations may have a single reference architecture that represents the enterprise digital identity infrastructure. In this scenario, system architects use the RA to find out how to connect to and use the enterprise infrastructure. For example, the enterprise may have a single, centrally managed directory, and the purpose of the reference architecture is to give system architects a blueprint for how they use this in their projects.

A larger organization needs to be more flexible. Large organizations will rarely be in a position where there is a single portal or set of web servers running a single authentication and authorization server connecting to a centralized corporate directory. More likely, there will be hundreds of separate projects, each of which builds some new part of the identity infrastructure as it is deployed.

In this scenario, the reference architecture needs to be deeper and more flexible as well. For example, suppose that the interoperability framework allows three different authentication and authorization servers because of scale and legacy issues. The reference architecture would need to show how any of those three servers can be used with various web server and portal products as well as how they attach to various pieces of the enterprise-wide system, such as the corporate metadirectory.