Guide to Implementing Decentralized ID

The Identity Fabric is presented as an architectural concept for managing access of everyone and everything to every digital service, replacing reliance on a disappearing network perimeter. With employees working from many locations and devices, accessing applications across internal, partner, supplier, and customer environments, identity becomes the primary security perimeter and requires dynamic access management. Consumers need more explicit, portable digital relationships, and devices performing critical work require unique identities for differentiation and lifecycle management. Because the Identity Fabric is a set of connected enabling components rather than a single product, it can be implemented in many ways, with decentralized identity offering advantages such as higher identity assurance, more confident ecosystem interactions, and reduced onboarding and verification administration.

A key characteristic is the coexistence of many identity types and technologies—eIDs, social logins, federation, directories, and Verifiable Credentials—making an API layer essential to provide consistent access to identity services (authentication, authorization, auditing, federation) across varied apps and identity methods. Decentralized identities often reside on user devices, with proofs anchored in a decentralized ledger, requiring secure API-based exchanges. Interoperability is emphasized: wallet/authenticator apps must integrate into Zero Trust flows, verify incoming credential requests, and use decentralized identifiers (DIDs) to validate request integrity and the requester’s identity via public keys. Integration should also align with common enterprise standards (OAuth, OpenID Connect, SAML, LDAP, AD), including issuing and authenticating Verifiable Credentials via OpenID Connect using existing IdP claims.

Organizations adopting decentralized identity typically need both issuance and verification capabilities, potentially including document proofing or biometrics. Cryptographic verification occurs on every presentation, enabling consumption of credentials from other issuers without formal trust relationships. In the IAM Reference Architecture, decentralized identity strengthens administration (vetting, issuance, self-service), authentication (adaptive methods, acceptance, federation), and supports privacy-centric authorization use cases such as secure attribute sharing and zero-knowledge proofs with explicit consent.

• The traditional network perimeter is disappearing, creating a fundamental shift in how organizational security is implemented.
• Employees access applications from varying locations and devices, including in partner, supplier, and customer networks.
• Devices performing critical work must have unique identities to differentiate and maintain them.
• The Identity Fabric is a set of connected enabling IT components rather than a single concrete tool.
• Decentralized identities are typically stored on a user’s device with proof of validity stored in a decentralized ledger.
• In the described flow, an application can generate a QR code via an API call for “login with Verifiable Credential.”
• A wallet can use a DID in a credential-sharing request to verify the requester and validate the request’s integrity.
• Organizations are expected to support standards including OAuth, OpenID Connect, SAML, LDAP, and AD.
• Verifiable Credentials can be issued using OpenID Connect, populated from claims already stored in an identity provider.
• Credential validity is cryptographically checked upon every consumption of a decentralized identity credential.

• “The Identity Fabric is a concept which organizations can follow to architect the ability to manage the access of everyone and everything to every digital service.”
• “Therefore, identity has become an essential security perimeter.”
• “Because the Identity Fabric describes a set of connected enabling IT components that work together as a single entity rather than a concrete tool, there are infinite possible implementations of an Identity Fabric.”
• “This means there must be a very secure call, response, and transfer of identity data between the user's device and the organization's systems.”
• “It is assumed that the Identity Fabric is working off of Zero Trust principles.”
• “The organization may determine that it is sufficient to generate a credential based on the attributes from their own directory, or may choose to include identity verification including biometric or government-issued document proofing in the credential.”
• “This is because of the built in ‘verification’ process when consuming a decentralized identity credential, where the credential's validity is cryptographically checked, no matter who issued it.”
• “Decentralized does not fulfill this capability in full, but it enables identity attributes to be securely shared between parties and with the use of zero-knowledge proofs can share the proof of credentials without disclosing any personal information.”
• “Consent is requested every time a credential is shared with another party.”
• “APIs are the secure access points for the Identity Fabric. Therefore API security is essential.”