Thales OneWelcome Identity Platform

Identity and Access Management (IAM) evolved from application-embedded controls into dedicated systems in the 1990s built on shared user directories (often LDAP), simplifying account creation and maintenance for employee users. Traditional workforce IAM focuses inward on provisioning, authentication, authorization, and storing relatively high-assurance identity data sourced during HR-led onboarding, with access entitlements flowing from groups, roles, and attributes. As collaboration and e-commerce expanded in the 2000s, enterprises began storing partner, supplier, and customer identities and building federations to authenticate users from external domains. By the late 2000s and early 2010s, consumer-facing organizations commonly deployed separate IAM instances for consumer identities, whose data and lifecycle differ materially from workforce identities and may include preferences, demographics, purchase histories, and user-generated content. Consumer identity creation is typically self-service registration (email/password or social login), with growing emphasis on privacy dashboards that let users grant and revoke consent under multiple global regulations.

The Thales OneWelcome Identity Platform is a multi-tenant SaaS CIAM offering (rebranded after Thales acquired OneWelcome in 2022) designed for consumers, B2B, workforce, and other scenarios. It comprises modules for core identity and access, user journey orchestration, delegated user management, externalized authorization (OPA-based), consent and preference management, mobile identity, and identity brokering, with in-country data residency across Europe, the Americas, and APAC. It supports customizable, white-labeled registration and login journeys using progressive profiling; broad authentication options including OTP, push, biometrics, and FIDO/U2F; configurable risk actions; extensive interoperability with identity proofing and national eID services (including eIDAS); IoT device linking via OAuth2 Device Flow; analytics and event streaming; and extensibility through APIs and connectors. Key strengths include consent/privacy management (GDPR, CCPA, Kantara Consent Receipts), B2B delegation and relationship management, and fine-grained authorization, with noted challenges around compromised-credential intelligence, passive biometrics, and some admin self-service for risk tuning.

• Dedicated IAM systems began emerging in the 1990s and were often constructed on LDAP-based user databases.
• Many enterprises started storing partner, supplier, and customer identities in enterprise IAM systems in the early to mid 2000s.
• By the late 2000s and early 2010s, consumer-facing enterprises commonly deployed separate IAM instances for consumer end-users.
• OneWelcome became a new brand in 2021 after iWelcome and Onegini (both founded in 2011) joined together.
• OneWelcome acquired Scaled Access in early 2022.
• Thales Group acquired OneWelcome in October 2022, and organizational integration completed in March 2023.
• The OneWelcome Identity Platform is delivered as a multi-tenant SaaS hosted on two public IaaS providers.
• Migration from prior CIAMs is supported via LDAP and SCIM.
• OneWelcome Externalized Authorization supports fine-grained authorization based on the Open Policy Agent (OPA).
• The platform supports consumer IoT device identity management via the OAuth2 Device Flow specification.

• “CIAM platforms have moved to accommodate many different privacy regulations globally, by offering consumer or customer users the facility to view, grant, and revoke consent for the use of their personal information.”
• “For businesses, CIAM solutions are the means by which they can improve customer experiences through personalization.”
• “SaaS delivery of CIAM services is the norm and will remain so.”
• “Improving the consumer experience is often a key goal in deploying or upgrading CIAM solutions.”
• “The User Journey Orchestration module helps customers build user-friendly journeys employing the progressive profiling concept, in which consumer information is collected on an as-needed basis, with consent, and in a way that does not impede providing service to the user.”
• “The solution recognizes and works with all eIDAS compliant identities.”
• “Consent collection (as one of the six legal bases under GDPR for processing personal information) and enforcement is required across all communication channels.”
• “OneWelcome Identity Platform facilitates consumer IoT device identity management via the OAuth2 Device Flow specification.”
• “Thales offers zero downtime service level agreements.”
• “Today, tenants are using their platform in novel ways to allow their consumers to integrate their real-world purchases with their avatars in the metaverse.”