ERO Product Backlog: CAF/WAF Landing Zone & Federated Identity

Synkronyx Ltd - We are Synchronisation | Powered by SynkronyXr© Engines (Clashfinder SynkronyXr©, Logbook SynkronyXr©, Playlist List SynkronyXr©)

---

Epic 1: CAF & WAF Aligned Landing Zone Vending Machine

Description: Establish a fully automated, compliant, and secure Azure landing zone foundation using the Cloud Adoption Framework (CAF) and Well-Architected Framework (WAF) principles. This machine will vend subscriptions and enforce governance.

Feature 1.1: CAF Management Group & Subscription Vending

User Story:

• As a Platform Engineer,
• I want a tenant-scoped Bicep template that deploys a CAF-aligned management group hierarchy,
• So that new subscriptions for ERO workloads (non-prod, prod, platform) can be vended and governed automatically.

Acceptance Criteria:

Scenario	Given	When	Then
Happy path	A deployment is run at the tenant scope (/).	infra/main.bicep is executed.	The mg-sknx- root, mg-sknx-ero-, and environment-specific MGs are created, and subscription aliases are placed within them.
Governance	A new subscription is created.	It is placed under the ERO Non-Production MG.	Azure Policies for non-prod environments are automatically applied.

Feature 1.2: WAF-Aligned Foundational Security & Governance

User Story:

• As a Security Architect,
• I want to apply baseline WAF security policies for logging, diagnostics, and network controls,
• So that all vended resources within the ERO landing zone are secure by default.

Acceptance Criteria:

Scenario	Given	When	Then
Policy Assignment	The landing zone deployment completes.	Azure Policy assignments are checked.	Policies for "Audit Diagnostic Settings" and "Deny Public IP" are assigned at the appropriate MG scope.

---

Epic 2: Platform Identity Service (Entra External ID)

Description: Provision and configure Microsoft Entra External ID as the central Customer Identity and Access Management (CIAM) platform, isolated by environment.

Feature 2.1: Automated Entra External ID Tenant Provisioning

User Story:

• As a Platform Engineer,
• I want a Bicep module that provisions an Entra External ID tenant,
• So that we have a dedicated, isolated directory for ERO festival attendees.

Acceptance Criteria:

Scenario	Given	When	Then
Happy path	The identity.bicep template is deployed to the platform subscription.	The modules/ciam.bicep module is invoked.	A new Azure resource of type Microsoft.ExteranlId/externalIdentities is created successfully.
Multi-environment	The deployment loops through dev, test, prod.	The CIAM module runs for each environment.	Separate CIAM tenants (sknxerodev, sknxerotest, sknxeroprod) are provisioned.

Feature 2.2: Secure Key Vault for Identity Secrets

User Story:

• As a Security Engineer,
• I want all secrets, keys, and certificates generated by the CIAM tenant to be stored in an Azure Key Vault,
• So that application secrets are managed securely and accessed via managed identity.

Acceptance Criteria:

Scenario	Given	When	Then
Secret Storage	The CIAM tenant is provisioned.	The associated Key Vault is inspected.	Secrets for application registrations (client secrets, etc.) are present in the vault.

---

Epic 3: Federated Identity Provider Integration

Description: Enable seamless social sign-on for festival attendees by integrating leading identity providers (IdPs) with the Entra External ID tenant.

Feature 3.1: Google Identity Federation

User Story:

• As a festival attendee,
• I want to sign in to the ERO PWA using my existing Google account,
• So that I don't have to create and remember a new password.

Acceptance Criteria:

Scenario	Given	When	Then
Happy path	A user clicks "Sign in with Google".	They are redirected to the Google OAuth consent screen and approve.	They are logged into the ERO application, and a user record is created in the Entra ID tenant.

Feature 3.2: Facebook Identity Federation

User Story:

• As a festival attendee,
• I want to sign in to the ERO PWA using my existing Facebook account,
• So that I can register quickly and easily.

Acceptance Criteria:

Scenario	Given	When	Then
Happy path	A user clicks "Sign in with Facebook".	They are redirected to the Facebook login and consent dialog.	They are logged into the ERO application.

Feature 3.3: Apple Identity Federation

User Story:

• As a festival attendee with an iPhone,
• I want to use "Sign in with Apple" for a private and secure login experience,
• So that I can use Face ID and hide my email address.

Acceptance Criteria:

Scenario	Given	When	Then
Happy path	A user clicks "Sign in with Apple".	They authenticate using Face ID/Touch ID.	They are logged into the ERO application, potentially with a private relay email address.

Feature 3.4: Samsung Identity Federation (Research & Implementation)

User Story:

• As a Platform Engineer,
• I want to investigate and, if available, implement Samsung Account as a federated identity provider,
• So that we can provide a native login experience for users with Samsung devices.

Acceptance Criteria:

Scenario	Given	When	Then
Research	The Entra ID provider documentation is reviewed.	A search for "Samsung" is performed.	A determination is made on whether Samsung is a supported, out-of-the-box provider or requires a custom OIDC configuration.
Implementation	If supported, the Samsung provider is configured.	A user with a Samsung device attempts to log in.	They are successfully authenticated.

---

Epic 4: ERO Application & API Integration

Description: Connect the Astro PWA frontend and Cloudflare Worker backend to the new Entra External ID service for end-to-end authentication and authorization.

Feature 4.1: PWA Authentication with MSAL

User Story:

• As a Frontend Developer,
• I want to integrate the Astro PWA with the Microsoft Authentication Library (MSAL.js),
• So that the application can acquire and securely store JWTs from Entra External ID.

Acceptance Criteria:

Scenario	Given	When	Then
Token Acquisition	A user successfully logs in via a federated IdP.	The MSAL library handles the OIDC redirect.	An access token and ID token are acquired and stored securely in the browser.

Feature 4.2: Edge API Authorization

User Story:

• As a Backend Developer,
• I want the Cloudflare Worker API to validate JWTs on all protected endpoints,
• So that only authenticated and authorized users can access or modify their data.

Acceptance Criteria:

Scenario	Given	When	Then
Valid Token	A request with a valid Bearer token is sent to /api/preferences.	The worker middleware validates the token signature against the Entra JWKS endpoint.	The request is processed successfully (HTTP 200).
Invalid Token	A request with an expired or invalid token is sent.	The middleware fails to validate the token.	The API returns an HTTP 401 Unauthorized error.