Federated API identity
JWT validation, signing-key discovery, audience authorization, and Microsoft identity integration for AWS-hosted services.
The system at a glance.
A conceptual view of the flow and its boundaries.
The challenge.
APIs and internal tools need to trust enterprise identity tokens while applying service-specific access boundaries and keeping credentials out of source code.
My contribution.
Worked across Python custom authorizers, OAuth/OIDC integrations, and AWS-hosted applications using Microsoft identity.
Implementation.
- Validate RS256 signatures and token issuer, audience, and expiration using enterprise signing keys.
- Resolve API audience authorization from DynamoDB and construct IAM policies for API Gateway.
- Cache signing-key discovery results and retrieve integration credentials through managed secret storage.
- Connect internal browser lookup to Microsoft SSO through ALB OIDC.
Design decisions.
Warm-instance caching reduces token validation dependencies but must be considered alongside signing-key rotation and access revocation.
Token validation establishes identity; service-specific policy decides what that identity may access.
Validation.
Component and acceptance tests exercise token validation and authorization boundaries.
The outcome.
Integrated enterprise identity with AWS API and browser-facing access paths.
Explore the pattern.
The companion repository is an independent educational demonstration built with synthetic examples. It illustrates related engineering patterns and does not contain employer source code or production data. Repositories are currently private; please contact me for access.
Open private GitHub demo