Connect Overview

Architecture

Learn about Raidiam Connect functional architecture and all components of the platform.
﻿
Raidiam Connect Functional Architecture
﻿
Security Components
#
Component
Description
1
Internet Perimeter Defence Layer
A comprehensive, defence-in-depth internet perimeter comprising the following capabilities:
 Intrusion Detection and Prevention Service (IDS/IPS)
Network firewalls and Network Access Control
Web Application Firewalls
DDOS Protection
Internet Gateways
2
Load Balancer & Transport Termination
Hyper-scalable application load balancer to distribute traffic within and across geographic regions and data centres with heartbeats and autoscaling built-in.
TLS termination device to enforce TLS cipher suites and policies to meet FAPI standards and certification including certificate validation and HTTP header forwarding.
3
API Service Tier / Policy Enforcement Point (PEP)
A PEP is an identity enabled access gateway component that serves as a gatekeeper to a digital resource. It operates as a reverse-proxy gateway, deployed between the consumer of the resource and the resource itself that it protects. Comprising a flexible policy engine, it intercepts all incoming requests and evaluates by obtaining a decision (Allow or Deny) based on defined policy and then enforces that decision e.g. permit onward connection to resource.
The server hosts and exposes the protected resources that the PEP is protecting. In OAuth2 terms the IAM PEP is performing the role of OAuth2 ‘resource server’ and is also capable of accepting and responding to protected resource requests using access tokens that it introspects with an authorization server.
17
Common Security Services
Common Security Services consist of services designed to protect the integrity, availability, and confidentiality of the platform. These services include privileged access management, multi- factor authentication, authorization, data encryption, intrusion detection and prevention, security event logging and monitoring, and vulnerability management.
﻿
Directory Components
#
Component
Description
4
Directory Services
Directory Services comprise all the essential API endpoints required for interacting with the Directory. These services are securely protected using Mutually authenticated TLS (MTLS).
All Directory APIs are served following the RESTful architectural style, providing a standardized, stateless communication method that allows for scalability, simplicity, and performance.
5
Directory User Interface
Directory UI is the web-based graphical user interface frontend component that interacts with Directory Services.
It provides a visual interface that administrators and users can interact with to manage and access the resources of the Directory. All functions available through the GUI are similarly available through the API as an API-first platform.
6
OpenID Provider (OP) & IdP
OpenID Provider (OP) is a system that implements the Provider role of an OpenID connect system and issues identity tokens that describe who is authenticated as part of an OAuth2 authorization.
Identity Provider (IDP) is a system that creates, maintains, and manages identity information for all principals (users, services, or systems). It provides principal authentication to other service providers within a federation or distributed network and sends attribute assertions containing trusted information about the user.
An IPD is also the component responsible for implementing multi-factor authentication of users and authenticating OAuth2 clients / OIDC Relying Parties. Finally, it is the central Identity provider and federation point for any ecosystem enabling single sign on functionality for all registered users.
7
Persistent Database
A Persistent Database stores and manages all data in the system in a highly scalable and redundant fashion. This database provides a way to save and retrieve data across different sessions or over a long period of time. The data stored in a persistent database is often structured (both relational and non-relational) and can be queried and manipulated.
Learn more about  Centralized Directory﻿.
Public Key Infrastructure Components
#
Component
Description
8
Registration Authority
A Registration Authority (RA) is responsible for verifying the eligibility of PKI Participants and ensuring the accuracy of information provided during the certificate request process.
An RA is responsible for screening / validating the certificate request from the applicant / subscriber and deciding if it should be accepted. And if acceptable, submitting the certificate request to Certificate Authority (CA) for signing.
9
Certificate Authority
A Certificate Authority (CA) authenticates the identity of the subscriber entities and binds them with a cryptographic key. The CA manufactures (digitally signs the public key submitted with its private key) and issues the digital certificate and returns it to the RA for onward transmission to the subscriber. These digital certificates are used in public key cryptography functions.
10
Certificate Validation Services
Certificate Validation Services are used to verify the authenticity and validity of a digital certificate. This can include checking the certificate's status (whether it's active, revoked, or expired), verifying the certificate's signatures, and ensuring the certificate was issued by a trusted Certificate Authority.
11
Key Management Services
Key Management Services (KMS) deal with the secure lifecycle management and administration of cryptographic keys used to encrypt or digitally sign data. This includes dealing with the secure generation, exchange, use, storage and replacement of keys. KMS encompasses key lifecycle management, key storage, and cryptographic functionality.
12
Public Key Stores (JWKS)
Public Key Stores (JWKS) are the hosted JSON Web Key Sets (JWKS) for each organisation and software instance in an ecosystem. The system maintains active and inactive keys at individual software and organization level which correlates to the status of the corresponding digital certificate.
A centrally managed and integrated Public Key Store (in JWKS format) is critical to ensuring that the ecosystem API consumers and relying parties have a single trust anchor and location to obtain the necessary public keys.
Learn more about  Public Key Infrastructure﻿.
Common Services
#
Component
Description
13
Email Notifications
Email Notifications service sends an email message based on certain triggers or conditions. They can be used to alert users about important events, updates, or confirmations in the Directory.
14
SMS Notifications
SMS Notifications service sends text messages to a user's mobile SMS device based on specific events or conditions. Used in multi-
factor authentication process.
15
eSignature Services
eSignature Services provide the capability to electronically sign documents, verifying the signer's identity and their intent to sign the document. This service is legally recognized in many jurisdictions and is used for contracts or other official documents
16
Administration Services
Administration Services provide administrators with the capabilities to manage, control, and monitor the platform. This includes user management and monitoring system activity.
﻿

#	Component	Description
1	Internet Perimeter Defence Layer	A comprehensive, defence-in-depth internet perimeter comprising the following capabilities: Intrusion Detection and Prevention Service (IDS/IPS) Network firewalls and Network Access Control Web Application Firewalls DDOS Protection Internet Gateways
2	Load Balancer & Transport Termination	Hyper-scalable application load balancer to distribute traffic within and across geographic regions and data centres with heartbeats and autoscaling built-in. TLS termination device to enforce TLS cipher suites and policies to meet FAPI standards and certification including certificate validation and HTTP header forwarding.
3	API Service Tier / Policy Enforcement Point (PEP)	A PEP is an identity enabled access gateway component that serves as a gatekeeper to a digital resource. It operates as a reverse-proxy gateway, deployed between the consumer of the resource and the resource itself that it protects. Comprising a flexible policy engine, it intercepts all incoming requests and evaluates by obtaining a decision (Allow or Deny) based on defined policy and then enforces that decision e.g. permit onward connection to resource. The server hosts and exposes the protected resources that the PEP is protecting. In OAuth2 terms the IAM PEP is performing the role of OAuth2 ‘resource server’ and is also capable of accepting and responding to protected resource requests using access tokens that it introspects with an authorization server.
17	Common Security Services	Common Security Services consist of services designed to protect the integrity, availability, and confidentiality of the platform. These services include privileged access management, multi- factor authentication, authorization, data encryption, intrusion detection and prevention, security event logging and monitoring, and vulnerability management.

#	Component	Description
4	Directory Services	Directory Services comprise all the essential API endpoints required for interacting with the Directory. These services are securely protected using Mutually authenticated TLS (MTLS). All Directory APIs are served following the RESTful architectural style, providing a standardized, stateless communication method that allows for scalability, simplicity, and performance.
5	Directory User Interface	Directory UI is the web-based graphical user interface frontend component that interacts with Directory Services. It provides a visual interface that administrators and users can interact with to manage and access the resources of the Directory. All functions available through the GUI are similarly available through the API as an API-first platform.
6	OpenID Provider (OP) & IdP	OpenID Provider (OP) is a system that implements the Provider role of an OpenID connect system and issues identity tokens that describe who is authenticated as part of an OAuth2 authorization. Identity Provider (IDP) is a system that creates, maintains, and manages identity information for all principals (users, services, or systems). It provides principal authentication to other service providers within a federation or distributed network and sends attribute assertions containing trusted information about the user. An IPD is also the component responsible for implementing multi-factor authentication of users and authenticating OAuth2 clients / OIDC Relying Parties. Finally, it is the central Identity provider and federation point for any ecosystem enabling single sign on functionality for all registered users.
7	Persistent Database	A Persistent Database stores and manages all data in the system in a highly scalable and redundant fashion. This database provides a way to save and retrieve data across different sessions or over a long period of time. The data stored in a persistent database is often structured (both relational and non-relational) and can be queried and manipulated.

#	Component	Description
8	Registration Authority	A Registration Authority (RA) is responsible for verifying the eligibility of PKI Participants and ensuring the accuracy of information provided during the certificate request process. An RA is responsible for screening / validating the certificate request from the applicant / subscriber and deciding if it should be accepted. And if acceptable, submitting the certificate request to Certificate Authority (CA) for signing.
9	Certificate Authority	A Certificate Authority (CA) authenticates the identity of the subscriber entities and binds them with a cryptographic key. The CA manufactures (digitally signs the public key submitted with its private key) and issues the digital certificate and returns it to the RA for onward transmission to the subscriber. These digital certificates are used in public key cryptography functions.
10	Certificate Validation Services	Certificate Validation Services are used to verify the authenticity and validity of a digital certificate. This can include checking the certificate's status (whether it's active, revoked, or expired), verifying the certificate's signatures, and ensuring the certificate was issued by a trusted Certificate Authority.
11	Key Management Services	Key Management Services (KMS) deal with the secure lifecycle management and administration of cryptographic keys used to encrypt or digitally sign data. This includes dealing with the secure generation, exchange, use, storage and replacement of keys. KMS encompasses key lifecycle management, key storage, and cryptographic functionality.
12	Public Key Stores (JWKS)	Public Key Stores (JWKS) are the hosted JSON Web Key Sets (JWKS) for each organisation and software instance in an ecosystem. The system maintains active and inactive keys at individual software and organization level which correlates to the status of the corresponding digital certificate. A centrally managed and integrated Public Key Store (in JWKS format) is critical to ensuring that the ecosystem API consumers and relying parties have a single trust anchor and location to obtain the necessary public keys.

#	Component	Description
13	Email Notifications	Email Notifications service sends an email message based on certain triggers or conditions. They can be used to alert users about important events, updates, or confirmations in the Directory.
14	SMS Notifications	SMS Notifications service sends text messages to a user's mobile SMS device based on specific events or conditions. Used in multi- factor authentication process.
15	eSignature Services	eSignature Services provide the capability to electronically sign documents, verifying the signer's identity and their intent to sign the document. This service is legally recognized in many jurisdictions and is used for contracts or other official documents
16	Administration Services	Administration Services provide administrators with the capabilities to manage, control, and monitor the platform. This includes user management and monitoring system activity.

Connect Overview

Get Started