Flipkart Marketplace Platform  ·  View 24 of 25  ·  7 · Assurance

Identity and Access Flow

Who proves what, to whom, in what order — and what happens when a token is stolen.

Editable source SVG draw.io All views
Shopper Mobile app Envoy Gateway Keycloak Risk engine Order service Policy engine Audit log 1. phone number 2. PKCE auth request 3. device, geo, velocity 4. risk score 5. OTP, step-up if risky 6. access 15 min + refresh 7. GET /orders + bearer 8. verify JWT, no introspect 9. mTLS + identity header 10. may this subject read? 11. allow, field mask 12. access record 13. orders, masked PII 14. refresh, rotate token 15. reuse detected: revoke family Identity — Who Proves What, To Whom, In What Order Customers, sellers and staff use three separate realms. Staff and seller staff federate to Microsoft Entra ID with conditional access; only the customer realm is Keycloak-native, and no realm shares a token audience. v 1.0 · owner Security Architecture · date 2026-09

Decisions

  • Keycloak for the 500M-strong customer realm; Microsoft Entra ID for staff and seller staff, with conditional access
  • Three realms, three audiences, no shared tokens — a seller token cannot be replayed against a customer API
  • The gateway verifies the JWT signature locally rather than introspecting, so identity is not on the hot path

Token handling

  • 15-minute access tokens with rotating refresh tokens; reuse of a rotated refresh token revokes the whole family
  • Step-up authentication is risk-driven — device, geography and velocity — not applied to every login
  • Authorisation is a policy decision at the service, returning a field mask, so the same endpoint returns less to a lower-trust caller

Why not managed identity for customers

  • Entra External ID priced per monthly active user is not viable at this population
  • Keycloak self-hosted is a real operational burden — an HA cluster, an upgrade treadmill and a team that owns it
  • The trade is accepted for the customer realm only; every internal and privileged identity stays on Entra
◀  Security Zones All views Trust and Marketplace Governance  ▶
Solution Architecture v1.0 · Open source on Microsoft Azure · Enterprise Architecture · 2026-0924-identity-and-access-flow