SSO requirements

1. Identity Provider Integration
1.1. Integrate Auth0? as the centralized Identity Provider (IdP) for managing user authentication and authorization across all products and applications within Ideagen. The IdP will be responsible for handling user identities, authentication, and authorization requests.   
1.2. Support standard authentication protocols like OIDCCD   and SAML   for seamless integration with external systems and applications. 
1.3. Enable federated identity management to facilitate authentication across different systems and identity sources. Users should be able to authenticate using their existing identities or other identity providers. 
1.4. Ensure seamless integration or user authentication fallback methods for applications that may not fully support modern protocols like OICD.

2. User Management
2.1 Maintain a centralized user directory  in IdP (Auth0) for managing user identities and attributes. This directory will serve as the authoritative source for user information, ensuring consistency and avoiding data duplication across different systems.
2.2 (Future) Implement user provisioning and deprovisioning workflows, including synchronization with existing user data sources. This will ensure that user accounts are created, updated, and deactivated in a timely and consistent manner across all integrated systems. 
•	* Present provisioning is manual
•	Synchronization is based on one way sync (pls refer to User Sync requirement)
2.3 Provide self-service capabilities for users to manage their profiles, update personal information, and reset passwords.   (refer to Setting/User Management in iHome User Stories)

3. Multi-Factor Authentication (MFA) – Future Phase
3.1. Implement MFA capabilities using IdP (Auth0) to enhance security for user authentication.
3.2. Support various MFA factors   like one-time passwords (OTP), push notifications, biometrics, and hardware tokens. 

4. Auditing, Logging, and Monitoring
4.1. Implement comprehensive auditing and logging mechanisms for authentication and authorization events. This will provide a detailed audit trail   for security, compliance, and troubleshooting purposes.
4.2. Integrate with existing logging and monitoring systems for centralized log management  and analysis. This will allow for aggregating and analyzing logs from various sources, enabling better visibility and insights.
4.3. (Future phase) Implement real-time monitoring and alerting for suspicious activities, failed login attempts, potential security threats, and performance degradations, with the ability to trigger automated response and remediation workflows. This will enable timely detection and response to security incidents, minimizing the potential impact of breaches or unauthorized access.

5. High Availability  
5.1. Implement high availability and failover mechanisms to ensure uninterrupted service and minimize downtime. This will provide redundancy and ensure that the SSO solution remains accessible even in the event of hardware or software failures.

6. Migration and Integration
6.1. Migration for transitioning from existing authentication systems (e.g., Keycloak to Auth0), ensuring data integrity and preserving user access. The migration is done in such a way with minimum disruptions and maintain continuity of access for users.
6.2. Provide support for legacy systems that do not support SSO, implementing fallback mechanisms or integration adapters as needed. 

7. User Interface (UI) – see iHome Requirements
7.1. Develop a dedicated SSO portal or dashboard that serves as a centralized access point for users to discover and launch authorized applications. The SSO portal should provide a user-friendly interface for accessing applications and services after successful authentication. 
7.2. Provide user self-service capabilities within the SSO portal, allowing users to update their personal information, manage their account settings, and reset their passwords without requiring administrative intervention. 

8. Password Policy/Complexity  
8.1. Establish minimum password length requirements, typically a minimum of 8-12 characters.
8.2. Require a combination of character types, such as uppercase letters, lowercase letters, numbers, and special characters.
8.3. Implement password complexity rules that prevent the use of common or easily guessable passwords, such as dictionary words, personal information (e.g., names, dates of birth), or sequential or repetitive patterns.
8.4. Enforce password expiration policies that require users to change their passwords periodically (for example, every 90 days).   To notify users before their password expiration is due (ie., 7 days, 1 day)
8.5. Implement password history rules that prevent users from reusing a certain number of previously used passwords (ie., the last 5 passwords, to discourage password cycling.)
8.6. Provide clear and user-friendly error messages and guidance during password creation or reset to assist users in meeting the defined password policy requirements.
8.7. Allow users to set password hints or security questions to aid in password recovery processes while ensuring that the hints or questions themselves do not reveal sensitive information.
8.8. Provide self-service password reset capabilities that allow users to securely reset their passwords without requiring administrative intervention.
8.9. Implement password lockout policies to temporarily lock user accounts after a specified number of consecutive failed login attempts within a defined time period.
•	maximum number of consecutive failed login attempts allowed before triggering the account lockout (e.g., 5 failed attempts).
•	the duration for which the account will be locked out (e.g., 1 hour, or until an administrator unlocks the account).
•	Notify users and administrators when an account is locked out due to too many failed login attempts.
•	Administrators to unlock locked accounts after verifying the user's identity and ensuring the account has not been compromised.

9. Privacy and Consent Management 
9.1. Implement consent management mechanisms  to allow users to review and control the sharing of their personal information with integrated applications or services, in compliance with data privacy regulations (e.g., GDPR).
9.2. Ensure that users have the ability to access, correct, and request the deletion  of their personal data in compliance with privacy regulations like GDPR’s ‘Right to be Forgotten’.

10. Disaster Recovery  and Business Continuity 
10.1. Implement data backup and replication mechanisms to enable rapid recovery and minimize data loss in case of system outages or failures. 
10.2. Establish redundant infrastructure and failover mechanisms to ensure high availability and minimize downtime during disaster scenarios.

11. Session Management 
11.1 Implement session policies  to control and manage user sessions for enhanced security:
•	Idle Timeouts: Set a time limit for user inactivity after which the session will automatically expire. For example, if a user doesn't interact with the system for 30 minutes, their session ends, and they have to log in again.  
11.2 Implement notification systems to alert users before their session expires due to inactivity. For example, a pop-up 5 minutes before timeout reminds them to save work and stay active.
11.3 Allow users to manually terminate their own sessions when they are done using the system by providing a clear "Log Out" option.


Pls help me answer comments raised, which refers to:
7.2: assume this is for non customer-federated users?
9.2: Who can access/correct/delete?