Design Identity Management - System Design | WinJob

Problem Statement & Enterprise IAM Context

Enterprise identity management is the control plane for who exists in your directory, how they authenticate, and what they may access across hundreds of SaaS and internal apps. Unlike a standalone login service, IAM unifies directories, RBAC/ABAC, federation (SAML/OIDC), provisioning (SCIM), and lifecycle (joiner-mover-leaver).

Key points

Directory is source of truth; apps consume claims via SSO
Authorization policies are versioned and auditable
Lifecycle automation prevents orphan privileged accounts

Deep dive

Interviewers at Okta, Azure AD, and SailPoint expect you to separate identity (profile, org structure) from authentication (credentials, MFA) and authorization (roles, policies). Size the problem with admin QPS, policy evaluation p95, and SCIM sync volume—not only login RPS.

javaOne Dark Pro

1 public final class IamContext1 {
2   private final String tenantId;
3   private final long policyBundleVersion;
4   public boolean isStale(long liveVersion) {
5     return policyBundleVersion < liveVersion;
6   }
7 }

pythonOne Dark Pro

1 @dataclass(frozen=True)
2 class PolicyDecision1:
3     subject: str
4     action: str
5     resource: str
6     allow: bool
7     bundle_version: int

typescriptOne Dark Pro

1 interface IamClaims1 {
2   sub: string;
3   tid: string;
4   bundleVer: number;
5   roles: string[];
6 }
7  
8 export function hasRole(c: IamClaims1, role: string): boolean {
9   return c.roles.includes(role);
10 }

Operational notes

Note 1.1: Map IAM context metrics to SSO success rate and PDP p95.
Note 1.2: Document tenant isolation before sizing IAM context stores.
Note 1.3: Publish policy bundle overlap when rotating IAM context signing keys.
Note 1.4: Rate-limit admin IAM context APIs with step-up MFA.
Note 1.5: Propagate deprovision events to all app integrators within minutes.
Note 1.6: Prefer WebAuthn over SMS for privileged IAM context operations.
Note 1.7: Shard directory rows by tenant_id for IAM context blast-radius control.
Note 1.8: Audit every IAM context mutation with actor and correlation_id.
Note 1.9: Fail closed when IAM context policy engine is unavailable.
Note 1.10: Run chaos tests on IdP cert expiry affecting IAM context.
Note 1.11: Size audit tiering for IAM context compliance retention windows.
Note 1.12: Precompute role graphs on publish to speed IAM context evaluation.

If pressed on blast radius, emphasize tenant-scoped policy bundles and break-glass accounts with extra logging.

Why interviewers care

Identity Management interviews reward crisp scope, explicit trade-offs, and failure stories—not generic microservice diagrams.

Interview checkpoint

Name one failure story for Problem Statement & Enterprise IAM Context that proves you understand real outages, not happy-path diagrams.

Key Highlights

•Directory is source of truth; apps consume claims via SSO
•Authorization policies are versioned and auditable
•Lifecycle automation prevents orphan privileged accounts

1	public final class IamContext1 {
2	private final String tenantId;
3	private final long policyBundleVersion;
4	public boolean isStale(long liveVersion) {
5	return policyBundleVersion < liveVersion;
6	}
7	}

1	@dataclass(frozen=True)
2	class PolicyDecision1:
3	subject: str
4	action: str
5	resource: str
6	allow: bool
7	bundle_version: int

1	interface IamClaims1 {
2	sub: string;
3	tid: string;
4	bundleVer: number;
5	roles: string[];
6	}
7
8	export function hasRole(c: IamClaims1, role: string): boolean {
9	return c.roles.includes(role);
10	}