ENTERPRISE UNIFIED SINGLE SIGN-ON

A centralized Identity and Access Management (IAM) platform built to unify authentication and user provisioning across seven internal telecom and operations applications. It implements a custom OAuth 2.0 authorization server with PKCE (S256), RS256-signed JWTs, TOTP two-factor authentication, approval-gated domain access requests, and HMAC-signed cross-application user sync.

• Custom OAuth 2.0 + PKCE & RS256 JWT Engine. Built a protocol-level authorization server (OAuth2Controller, JwtService) without third-party OAuth server packages — implementing 10-minute cache-held authorization codes with PKCE (S256) verification, asymmetric RS256 JWT signing, SHA-256 hashed refresh token rotation, and instant logout via a MySQL JTI blacklist (CheckJwtBlacklist).
• TOTP Two-Factor Auth & Account Hardening. Implemented Google Authenticator 2FA (TwoFactorAuthService) with QR SVG provisioning, encrypted secret storage, system-wide 2FA enforcement toggles, progressive failed-attempt lockouts (AuthAttemptService, locked_until), and signed-URL email verification.
• Cross-App Provisioning & Approval Workflows. Designed AccessRequestController and AccessAdminController to gate per-domain membership across 7 internal applications — automatically granting parent/sub-domain permissions on approval, propagating HMAC-SHA256 signed user updates (PropagateUserUpdateToDomains), and tracking two-way activation webhooks (external_active_status).
• Memory-Bounded Telecom Site Excel Ingestion. Engineered ProcessSiteExcelJob and ProcessHubExcelJob to ingest 200-column telecom site spreadsheets — pre-converting Excel to CSV with frozen formulas, staging rows in batches, upserting on site_name with per-row error capture, and driving adaptive frontend polling via observer-invalidated cache keys.

• Centralized Identity HubSingle-source-of-truth authentication serving independent web applications and services.
• Zero-Trust 2FA SecurityGoogle Authenticator TOTP implementation with secure recovery workflows and rate limiting.
• Cross-Domain Token SyncCryptographically signed JWT sessions with instant revocation and cross-app token validation.
• Approval-Based AccessSelf-service domain access request pipeline with admin moderation and audit logging.
• Bulk Data ProcessingQueue-driven Excel ingestion engine processing thousands of site records in the background.
• Rate Limiting & Brute-Force LockoutsProgressive failed-attempt lockouts, 2FA enforcement toggles, and signed-URL email verification gate token issuance and account access.