cidaas access management

Workforce Identity and Access Management (IAM) secures enterprise environments by ensuring only properly authenticated and authorized people gain access to digital resources. Core requirements include identity verification at onboarding, user and device management, identity lifecycle governance, strong authentication, secure authorization, access recertification, adaptive risk evaluation, consent management, and federation with other Identity Provider (IdP) services using standards like SAML, OAuth, and OpenID Connect. Modern approaches emphasize passwordless MFA, step-up authentication based on real-time risk, and fine-grained policy enforcement through RBAC and ABAC, where authorization decisions can depend on user, resource, and environmental attributes.

Widas’ cidaas, launched as a CIAM product in 2018 and now positioned for workforce IAM via the same “identity fabric,” is primarily delivered as SaaS across multiple public IaaS providers plus company facilities. It supports migration via LDAP, SCIM, and APIs, and allows self-registration from OIDC-compliant IdPs; it also supports Decentralized Identifiers, but not the W3C DID specification. A standout feature is AutoIdent for remote onboarding, combining document capture and facial recognition with liveness detection, optionally enhanced by NFC reads from chipped IDs; typical verification completes in 20–60 seconds and supports many document types to help meet eIDAS needs.

cidaas provides lifecycle management (deduplication, keepalive checks, de-registration), device intelligence and OAuth2 Device Flow, and a risk engine that can require step-up authentication or deny access. Authentication options include biometrics via a mobile app, FIDO U2F/FIDO2, OTP, push, and third-party authenticators; policies are configured via a flow-chart interface. Governance and fraud detection address recertification, bots, brute force, and credential stuffing. Differentiators include B2B IAM capabilities, extensive APIs, and integrated Physical Access Control Systems (PACS) with geofencing and offline validation. Challenges include no FIDO certification yet, lack of SOC 2 Type 2, and a partner ecosystem still maturing beyond the DACH region.

• Widas is a private company founded in Germany in 1997.
• The cidaas product and brand launched in 2018.
• cidaas initially gained significant traction in the DACH region and has been expanding into Benelux, Nordic countries, the US, and India.
• cidaas is primarily offered as a SaaS service hosted across multiple public IaaS providers and Widas facilities.
• User migration is supported via LDAP, SCIM, and custom APIs with mapping and normalization capabilities.
• AutoIdent verification typically completes in 20–60 seconds for a registration event.
• AutoIdent onboarding includes document capture plus facial recognition with liveness detection and can also use NFC reads on chipped IDs.
• Device management supports computers, smartphones, and IoT devices and includes support for the OAuth2 Device Flow standard.
• The platform supports up to 100 million logins and 1 billion transactions per day with up to 99.99% uptime and under 20 ms latency.
• cidaas states it manages roughly 1 billion user identities.

• “These solutions are designed to ensure that only properly authenticated and authorized individuals have appropriate access to digital resources, safeguarding sensitive information and critical systems from unauthorized access, breaches, espionage, and sabotage.”
• “Modern MFA systems can be passwordless, which eliminates the threat of leaked or weak passwords and minimizes the threat of phishing.”
• “Device attributes and intelligence can be analyzed periodically or continuously… to evaluate the risk associated with an authentication attempt in real-time.”
• “Authorization management in IAM is inherently complex, as it involves defining and enforcing access policies that dictate which resources a user can access and under what conditions.”
• “Consent management is becoming increasingly important, especially with stringent data privacy regulations like GDPR and CCPA.”
• “Identity lifecycle management requires regular audits, deactivation of dormant accounts, and the timely removal of access for terminated employees.”
• “For self-registration, cidaas' AutoIdent feature is engineered to facilitate remote identity verification dynamically and securely.”
• “AutoIdent incorporates liveness detection to guarantee that the selfie is taken live and is not a static image or a photograph of another photo.”
• “Administrators can define detailed authentication policies using a flow-chart style interface, customizing responses to different risk levels and use cases.”
• “Their customers are discovering that their identity fabric approach allows the features for customer identity work equally well for employees, contractors, and partners.”