Internal Web Application for User Account Management

About Client

This is an internal project that will be widely used within our company. We are Elinext, an international software development company that delivers custom solutions.

We are focused on providing the best possible software to our customers, and there are cases when our products are handy for internal use. Elinext Identity Management is one of 20+ software solutions used in everyday activities within our company.

Business Challenge

Elinext is a big international company. It is a fairly difficult task to manage people within the company, and it is next to impossible without dedicated software.

The company had used such software for a long time, but previous solutions had flaws. For instance, the solution was based on IdentityServer architecture, so adding new features was complex. The situation became harder when the IdentityServer4 library moved to a commercial license.

It was decided to switch to another library, OpenIddict, and rewrite the application entirely. Elinext Identity Management received a new life as a solution for managing users, roles, groups, and authorization for other applications.

Process

The project development was split into several phases.

1. Phase 1December 2023 - January 2024, MVP development
2. Phase 1.1January 2024 - March 2024
3. Phase 2April 2024 - January 2025

MVP development

• Renew the existing web application
• Refine all the existing modules

Phase 1.1 scope

• Logging using 2FA
• Scope management
• Application management

Phase 2 scope

• Group Management
• Custom User Roles per application
• Audit logging

Notes:

• The Kanban-like methodology was used on the project because it best suited an unlimited-time internal project with team rotation.
• From the technical point of view, many parts of the functionality were new to the team and required deep investigation.
• The development process stayed flexible because requirements often changed due to numerous dependencies and limitations.

Final Product Overview

• The web application helps with employee role management and access.
• The product supports the OAuth 2.0 specification.
• The system consists of several modules: Identity, OAuth 2.0, Administration, and External API.

Identity Module

It is part of the system available to all employees. The main functionality included is login.

The login page has 2FA authentication enabled, alongside a forgot password page, lockout page for blocked users, and a manage page for basic information, password settings, 2FA management, login history, and active session history.

OAuth 2.0 Module

It is part of the system responsible for authorization of external applications and issuance of access tokens.

The authorization endpoint can request tokens or auth codes through the browser. The Token endpoint can request tokens programmatically. UserInfo retrieves claims about a user, Introspection validates reference tokens, Discovery retrieves IdentityServer metadata, Revocation revokes access tokens, and End Session triggers single sign-out in the browser.

Administration Module

It is a part of the system that allows managing the main entities of the application.

Users, connected applications, scopes, companies, and groups are the app entities that admins can manage with this module.

External API Module

It is a part of the system for data retrieval by external applications.

External companies, countries, group members, group roles, groups, roles, and users are managed with this module.

Business Effects for Client

• Increased app performance, leading to more effective role management.
• Absence of bugs.
• Better logging and faster error correction.

Upcoming features:

• MFA using FIDO standard
• Deeper logging
• UI improvements