Chapter 8: Implementation & Certification

┌──────────────────────────────────────────────┐
│            Single Server Deployment           │
├──────────────────────────────────────────────┤
│  ┌────────────────────────────────────────┐ │
│  │     WIA-ACS All-in-One Server          │ │
│  │  ┌──────────┐  ┌──────────┐           │ │
│  │  │   API    │  │   Web    │           │ │
│  │  │ Services │  │  Portal  │           │ │
│  │  └────┬─────┘  └────┬─────┘           │ │
│  │       └──────┬───────┘                 │ │
│  │              │                         │ │
│  │    ┌─────────▼────────┐               │ │
│  │    │    PostgreSQL    │               │ │
│  │    └──────────────────┘               │ │
│  └────────────────────────────────────────┘ │
│                    │                        │
│         ┌──────────┴──────────┐            │
│         │                     │            │
│  ┌──────▼──────┐       ┌──────▼──────┐    │
│  │  Readers    │       │   Doors     │    │
│  └─────────────┘       └─────────────┘    │
└──────────────────────────────────────────────┘

Specs:
- CPU: 8 cores
- RAM: 32 GB
- Storage: 500 GB SSD
- Network: 1 Gbps
- Backup: Daily automated backups
            

┌───────────────────────────────────────────────────┐
│        Load-Balanced Multi-Server Deployment      │
├───────────────────────────────────────────────────┤
│                                                   │
│           ┌─────────────────────┐                │
│           │   Load Balancer     │                │
│           │   (HAProxy/Nginx)   │                │
│           └──────────┬──────────┘                │
│                      │                            │
│         ┌────────────┼────────────┐              │
│         │            │            │              │
│  ┌──────▼─────┐ ┌───▼──────┐ ┌──▼────────┐     │
│  │ API Server │ │ API Server│ │ API Server│     │
│  │    #1      │ │    #2     │ │    #3     │     │
│  └──────┬─────┘ └───┬──────┘ └──┬────────┘     │
│         └───────────┼───────────┘              │
│                     │                            │
│          ┌──────────▼──────────┐                │
│          │  PostgreSQL Cluster │                │
│          │  (Primary + Replica)│                │
│          └──────────┬──────────┘                │
│                     │                            │
│          ┌──────────▼──────────┐                │
│          │   Redis Cache       │                │
│          └─────────────────────┘                │
└───────────────────────────────────────────────────┘

Specs per API Server:
- CPU: 16 cores
- RAM: 64 GB
- Storage: 1 TB NVMe SSD
- Network: 10 Gbps
- Redundancy: N+1
            

┌─────────────────────────────────────────────────────────┐
│           Global Kubernetes Deployment                  │
├─────────────────────────────────────────────────────────┤
│                                                         │
│  ┌───────────────────────────────────────────────────┐ │
│  │           Content Delivery Network (CDN)          │ │
│  └─────────────────────┬─────────────────────────────┘ │
│                        │                                │
│         ┌──────────────┼──────────────┐                │
│         │              │              │                │
│  ┌──────▼────┐  ┌──────▼────┐  ┌──────▼────┐         │
│  │   US-West │  │  US-East  │  │   EU-West │         │
│  │  Cluster  │  │  Cluster  │  │  Cluster  │         │
│  └──────┬────┘  └──────┬────┘  └──────┬────┘         │
│         │              │              │                │
│  Each cluster contains:                                │
│  ├─ Ingress (Istio/Traefik)                           │
│  ├─ API Pods (auto-scaling 10-100 instances)          │
│  ├─ Worker Pods (async processing)                    │
│  ├─ Cache Layer (Redis Cluster)                       │
│  └─ Monitoring (Prometheus + Grafana)                 │
│                                                         │
│  ┌───────────────────────────────────────────────────┐ │
│  │         Multi-Region Database (CockroachDB)       │ │
│  │  ┌──────────┐  ┌──────────┐  ┌──────────┐        │ │
│  │  │ US-West  │  │ US-East  │  │ EU-West  │        │ │
│  │  │  Nodes   │  │  Nodes   │  │  Nodes   │        │ │
│  │  └────┬─────┘  └────┬─────┘  └────┬─────┘        │ │
│  │       └─────────────┼──────────────┘              │ │
│  │           Global Replication                       │ │
│  └───────────────────────────────────────────────────┘ │
└─────────────────────────────────────────────────────────┘

Specs per Kubernetes Node:
- CPU: 32 cores
- RAM: 128 GB
- Storage: 2 TB NVMe SSD
- Network: 25 Gbps
- Auto-scaling: CPU > 70% or Queue depth > 1000
            

Test Coverage Requirements:
├─ Authentication Service: > 90%
├─ Authorization Engine: > 95%
├─ Credential Management: > 90%
├─ Audit Logging: > 85%
└─ Integration Adapters: > 80%

Example Test Suite:

describe('AuthenticationService', () => {
  describe('authenticate()', () => {
    it('should authenticate valid credential + PIN', async () => {
      const result = await authService.authenticate({
        credentialId: 'cred-valid',
        factors: [{ type: 'pin', value: '1234' }]
      });
      expect(result.success).toBe(true);
      expect(result.accessToken).toBeDefined();
    });

    it('should reject invalid PIN', async () => {
      const result = await authService.authenticate({
        credentialId: 'cred-valid',
        factors: [{ type: 'pin', value: 'wrong' }]
      });
      expect(result.success).toBe(false);
      expect(result.error).toBe('INVALID_PIN');
    });

    it('should require MFA for high-security resources', async () => {
      const result = await authService.authenticate({
        credentialId: 'cred-admin',
        factors: [{ type: 'password', value: 'correct' }]
      });
      expect(result.mfaRequired).toBe(true);
    });
  });
});
            

End-to-End Test Scenarios:

1. User Provisioning Flow
   ├─ Create user in LDAP
   ├─ Wait for sync (< 5 minutes)
   ├─ Verify user created in WIA-ACS
   ├─ Check role mappings applied
   └─ Validate audit log entry

2. Access Grant Flow
   ├─ Issue credential to user
   ├─ Provision to PACS
   ├─ Present credential at reader
   ├─ Verify authentication
   ├─ Check authorization
   ├─ Confirm door unlock
   └─ Validate event chain

3. Access Revocation Flow
   ├─ Disable user in LDAP
   ├─ Wait for sync
   ├─ Verify credentials revoked
   ├─ Attempt access (should fail)
   ├─ Confirm PACS updated
   └─ Audit trail complete

4. MFA Authentication Flow
   ├─ User authenticates with password
   ├─ System requests TOTP
   ├─ User provides valid code
   ├─ Access token issued
   ├─ Token validates for API calls
   └─ Session expires correctly
            

Index Strategy:

CREATE INDEX idx_users_email ON users(email);
CREATE INDEX idx_users_external_id ON users(external_id);
CREATE INDEX idx_users_status ON users(status) WHERE status = 'active';

CREATE INDEX idx_credentials_user_id ON credentials(user_id);
CREATE INDEX idx_credentials_status ON credentials(status) WHERE status = 'active';
CREATE INDEX idx_credentials_expires_at ON credentials(expires_at);

CREATE INDEX idx_audit_timestamp ON audit_events(timestamp DESC);
CREATE INDEX idx_audit_user_id ON audit_events(user_id, timestamp DESC);
CREATE INDEX idx_audit_resource ON audit_events(resource_type, resource_id, timestamp DESC);

Partitioning Strategy:

-- Partition audit_events by month
CREATE TABLE audit_events_2025_12 PARTITION OF audit_events
    FOR VALUES FROM ('2025-12-01') TO ('2026-01-01');

-- Automatic partition creation
CREATE OR REPLACE FUNCTION create_monthly_partition()
RETURNS void AS $$
DECLARE
    partition_date DATE;
    partition_name TEXT;
BEGIN
    partition_date := DATE_TRUNC('month', CURRENT_DATE + INTERVAL '1 month');
    partition_name := 'audit_events_' || TO_CHAR(partition_date, 'YYYY_MM');
    EXECUTE format('CREATE TABLE IF NOT EXISTS %I PARTITION OF audit_events
        FOR VALUES FROM (%L) TO (%L)',
        partition_name,
        partition_date,
        partition_date + INTERVAL '1 month');
END;
$$ LANGUAGE plpgsql;

Query Optimization:

-- Before: Full table scan
SELECT * FROM credentials WHERE user_id = 'usr-001';
Execution time: 234ms (1M rows scanned)

-- After: Index scan
SELECT * FROM credentials WHERE user_id = 'usr-001' AND status = 'active';
Execution time: 3ms (2 rows returned)
            

Multi-Layer Cache:

L1: Application Memory (milliseconds)
├─ User session data
├─ Active credentials
└─ Recently accessed resources

L2: Redis (< 10ms)
├─ User profiles (TTL: 1 hour)
├─ Role permissions (TTL: 15 minutes)
├─ Authorization decisions (TTL: 5 minutes)
└─ API rate limit counters

L3: Database Query Cache (< 50ms)
├─ Materialized views for reports
├─ Aggregated statistics
└─ Reference data (buildings, doors)

Cache Invalidation:
- User update → Invalidate L1 + L2 user cache
- Role change → Invalidate L2 role cache + all user caches
- Credential revocation → Immediate L1/L2 purge
            

Security Headers:

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: geolocation=(), microphone=(), camera=()

Input Validation:

- Whitelist validation for all inputs
- Parameterized queries (prevent SQL injection)
- HTML encoding (prevent XSS)
- JSON schema validation for API requests
- File upload restrictions (type, size, scan for malware)