Daniel del Hoyo, Software Engineer, Zalando Mihai Dumitrescu, Software Engineer, Zalando Rob Ojevaar, IAM Architect, Zalando Zalando is a publicly traded e-commerce company with more than 16 million active customers in 15 European markets. These customers speak many different languages, have different tastes in products and styles, prefer different payment and shipping methods—and require non-stop innovation. Until very recently, our focus on identity and access management has been somewhat unclear—leading to inconsistencies that our explosive growth couldn’t sustain indefinitely. With the adoption of a tech management strategy called Radical Agility, which emphasizes autonomy and trust, we’ve not only rethought the way we build our systems, but also changed our perception of IAM. Following the motto “You build it, you run it,” our newly formed, autonomous teams are now responsible end-to-end for their own applications – which means they are also entrusted with securing them. In this talk, Zalando software engineers Daniel del Hoyo, Mihai-Aurelian Dumitrescu and Everett architect Rob Ojevaar will talk about how Zalando is transitioning to a cloud-based infrastructure that allows growing flexibility and abstraction. They’ll discuss how their team is supporting IAM to maximize stability and versatility. They will demonstrate how Narwhal, Zalando’s API framework for OpenAM, can help to solve challenges such as providing a stable interface during updates to the ForgeRock stack. Finally, they will demonstrate how Unicorn, a Zalando’s user-oriented interface, has helped the engineering team to use and explain OpenAM and identity management to recruiters, customer care agents and other non-technical users - making the myth reality.

3. EUROPE’S LEADING ONLINE FASHION PLATFORM
15 countries
3 fulfillment centers
16+ million active customers
2.2+ billion € revenue 2014
130+ million visits per month
9.000+ employees
Visit us: tech.zalando.com

6. DataCenter I
Gütersloh, Germany
DataCenter II
Berlin, Germany
DataCenter III
Berlin, Germany
APP 1
APP 2
APP 3
APP 4
APP 5
APP 6
APP 1
APP 2
APP 3
APP 4
APP 5
APP 6
APP 1
APP 2
APP 3
APP 4
FW FW
GLOBAL TRAFFIC MANAGEMENT

10. October
900+
Apps
800+
Tech employees

22. Unified Identity
Being in control of account, data and access regardless of its source
Unified Password
One password only to manage all accounts
Unified Flows
Ability to authenticate and authorize reliably for any identity
Unified cohesive architecture
Know you can trust an identity, without being aware of the protocol
Vision

23. THE PATH TO AWS
One AWS account per team
secured via SSL and OAuth 2.0
Deployment based on Docker
Usage of REST + OAuth is mandatory
Bye Monolith, hello Microservices

26. Project Goals
API’s

27. Project Goals
Services
API’s

28. Project Goals
Services
API’s
Roles
Employee

29. Project Goals
Services
API’s
Roles
Partner/Brands
Employee

30. Project Goals
Services
API’s
Roles
Partner/BrandsCustomers
Employee

44. Ah no wait, we don’t need magic,
We just need a Unicorn!

50. Shop rebuilt!
Microservices now!
protected with OAuth2!

51. But what if…
❖OpenAM needs to be updated?
❖… changes its interface
❖… or just doesn’t suit us
anymore?
We need an abstraction layer!
OpenAM
Customer
facing
application
OpenDJ“Customer”