Aarkam - SCT (Storage Centers Tier) SCT Control Plane Cyber Security • ARK-SEC-SCT-0403

Aarkam SCT Identity & Access Management (MFA, SSO, RBAC)

Centralized multi-tenant IAM, TOTP Multi-Factor Authentication, NIST password policies, session concurrency limits, and enterprise SSO for Aarkam Storage Centers Tier (SCT).

Last updated: Nov 03, 2026 Classification: Sovereign Tier-4 Enterprise

---
title: "Aarkam SCT Identity & Access Management (MFA, SSO, RBAC)"
description: "Centralized multi-tenant IAM, TOTP Multi-Factor Authentication, NIST password policies, session concurrency limits, and enterprise SSO for Aarkam Storage Centers Tier (SCT)."
category: "Cyber Security"
order: 3
badge: "SCT Control Plane"
icon: "user-check"
documentId: "ARK-SEC-SCT-0403"
status: "Normative Spec"
classification: "Sovereign Tier-4 Enterprise"
version: "V-1.0.0-GA (Production Stable)"
readingTime: "3 min read"
audience: "Enterprise Architects & Systems Engineers"
scope: "Aarkam Storage Centers Tier (SCT: AarkamIO Web Cloud)"
tier: "Aarkam - SCT (Storage Centers Tier)"
---

<div class="wiki-spec-card">
  <div class="wiki-spec-grid">
    <div class="wiki-spec-item">
      <span class="wiki-spec-label">Document Identifier</span>
      <span class="wiki-spec-value text-[#10B981]">ARK-SEC-SCT-0403</span>
    </div>
    <div class="wiki-spec-item">
      <span class="wiki-spec-label">Standard Status</span>
      <div><span class="status-pill status-normative">Normative Spec</span></div>
    </div>
    <div class="wiki-spec-item">
      <span class="wiki-spec-label">Architecture Tier</span>
      <span class="wiki-spec-value text-amber-300">Aarkam - SCT (Storage Centers Tier)</span>
    </div>
    <div class="wiki-spec-item">
      <span class="wiki-spec-label">Release Version</span>
      <span class="wiki-spec-value text-cyan-300">V-1.0.0-GA (Production Stable)</span>
    </div>
  </div>
</div>

<div class="wiki-alert wiki-alert-note my-4 p-4 rounded-xl border border-emerald-500/20 bg-emerald-500/5 text-xs text-slate-300">
  <strong class="text-emerald-400 block mb-1">Architecture Tier Scope: Aarkam - SCT (Storage Centers Tier)</strong>
  This specification applies to the centralized multi-tenant Web Management Console, OpenID Connect / OAuth2 SSO integrations, and database-backed IAM in <strong>Aarkam - SCT (AarkamIO Web Cloud)</strong>. For autonomous, zero-database operator identity and Raft consensus authority in <strong>Aarkam - SAT (Standalone Tier)</strong>, see <a href="/wiki/cyber-security/sat-sovereign-authority-identity" class="text-emerald-400 underline">SAT Sovereign Authority &amp; Operator Identity</a>.
</div>

<p>Aarkam SCT’s Identity &amp; Access Management (IAM) tier enforces stringent enterprise security controls aligned with <strong>NCA ECC-2:2024 §2-2</strong>, <strong>NIST SP 800-63B</strong>, and <strong>ISO/IEC 27001:2022</strong>.</p>
<hr />
<h2 id="multi-factor-authentication-mfa-totp">1. Multi-Factor Authentication (MFA / TOTP)</h2>
<p>Aarkam enforces hardware or software TOTP Multi-Factor Authentication across all administrative and tenant-privileged access:</p>
<ul>
<li><strong>Algorithm:</strong> RFC 6238 Time-Based One-Time Password (TOTP)</li>
<li><strong>Time Step:</strong> 30 seconds with 1-step drift tolerance</li>
<li><strong>Enrollment:</strong> Secure QR-code provisioning with encrypted shared secrets for Microsoft Authenticator, Google Authenticator, and hardware YubiKeys.</li>
<li><strong>Service Implementation:</strong> Implemented in <code>IMfaService</code> and required prior to generating API tokens or accessing administrative panels.</li>
</ul>
<hr />
<h2 id="password-governance-nist-compliance">2. Password Governance &amp; NIST Compliance</h2>
<p>User authentication enforces strict cryptographic hygiene in <code>AarkamPersistenceModule</code>:</p>
<div class="wiki-table-wrapper">
  <table class="wiki-spec-table">

<thead>
<tr>
<th style="text-align: left;">Policy</th>
<th style="text-align: left;">Setting</th>
<th style="text-align: left;">Standard Compliance</th>
</tr>
</thead>
<tbody>
<tr>
<td style="text-align: left;"><strong>Minimum Length</strong></td>
<td style="text-align: left;">12 characters minimum (configurable up to 64)</td>
<td style="text-align: left;">NIST SP 800-63B §5.1.1.2</td>
</tr>
<tr>
<td style="text-align: left;"><strong>Character Diversity</strong></td>
<td style="text-align: left;">Uppercase, lowercase, digit, and special symbol mandatory</td>
<td style="text-align: left;">NCA ECC-2:2024 §2-2-3-1</td>
</tr>
<tr>
<td style="text-align: left;"><strong>Brute-Force Lockout</strong></td>
<td style="text-align: left;">5 failed attempts triggers 15-minute progressive lockout</td>
<td style="text-align: left;">OWASP ASVS §2.2.1</td>
</tr>
<tr>
<td style="text-align: left;"><strong>Password Expiry</strong></td>
<td style="text-align: left;">90-day forced rotation for privileged accounts</td>
<td style="text-align: left;">SAMA CSF §3.2.4</td>
</tr>
<tr>
<td style="text-align: left;"><strong>Historical Prevention</strong></td>
<td style="text-align: left;">Cannot reuse the last 5 previous passwords</td>
<td style="text-align: left;">NCA ECC-2:2024 §2-2-3-2</td>
</tr>
</tbody>

</table>
</div>
<hr />
<h2 id="session-security-concurrency-limits">3. Session Security &amp; Concurrency Limits</h2>
<p>Session management prevents concurrent hijackings and unauthorized credential re-use:</p>
<ul>
<li><strong>Idle Session Expiry:</strong> 15 minutes of inactivity automatically terminates administrative sessions.</li>
<li><strong>Absolute Session Lifetime:</strong> 8 hours maximum duration, requiring re-authentication regardless of activity.</li>
<li><strong>Concurrent Session Limit:</strong> Maximum of 2 active concurrent sessions per administrative user. Subsequent logins invalidate previous session tokens via epoch revocation.</li>
<li><strong>Cookie Security Attributes:</strong> All authentication cookies are injected with <code>SameSite=Strict</code>, <code>Secure</code>, and <code>HttpOnly</code> flags.</li>
</ul>
<hr />
<h2 id="role-based-access-control-rbac-hierarchy">4. Role-Based Access Control (RBAC) Hierarchy</h2>
<p>Granular operational roles prevent lateral privilege escalation across sovereign tenant boundaries:</p>
<div class="wiki-table-wrapper">
  <table class="wiki-spec-table">

<thead>
<tr>
<th style="text-align: left;">Role Identifier</th>
<th style="text-align: left;">Scope</th>
<th style="text-align: left;">Assigned Capabilities</th>
</tr>
</thead>
<tbody>
<tr>
<td style="text-align: left;"><strong><code>SuperAdmin</code></strong></td>
<td style="text-align: left;">Global System</td>
<td style="text-align: left;">Genesis bootstrap authority, KMS HSM master key management, raw storage pool partitioning, emergency cluster lockdown.</td>
</tr>
<tr>
<td style="text-align: left;"><strong><code>TenantAdmin</code></strong></td>
<td style="text-align: left;">Tenant Namespace</td>
<td style="text-align: left;">Bucket creation, user account provisioning within tenant scope, IAM policy mapping, WORM Object Lock configuration.</td>
</tr>
<tr>
<td style="text-align: left;"><strong><code>StorageOperator</code></strong></td>
<td style="text-align: left;">Physical Fabric</td>
<td style="text-align: left;">Storage node diagnostics, SMART telemetry inspection, offline disk maintenance windows, rebalance job tracking.</td>
</tr>
<tr>
<td style="text-align: left;"><strong><code>SecurityAuditor</code></strong></td>
<td style="text-align: left;">Audit Plane</td>
<td style="text-align: left;">Read-only access to immutable WORM audit logs, compliance reports, cryptographic key rotation timestamps.</td>
</tr>
<tr>
<td style="text-align: left;"><strong><code>S3User</code></strong></td>
<td style="text-align: left;">Bucket Data</td>
<td style="text-align: left;">SigV4 object upload, download, and multi-part streaming bounded strictly by tenant bucket ACLs.</td>
</tr>
</tbody>

</table>
</div>

Document Identifier ARK-SEC-SCT-0403

Standard Status

Normative Spec

Architecture Tier Aarkam - SCT (Storage Centers Tier)

Release Version V-1.0.0-GA (Production Stable)

Architecture Tier Scope: Aarkam - SCT (Storage Centers Tier) This specification applies to the centralized multi-tenant Web Management Console, OpenID Connect / OAuth2 SSO integrations, and database-backed IAM in Aarkam - SCT (AarkamIO Web Cloud). For autonomous, zero-database operator identity and Raft consensus authority in Aarkam - SAT (Standalone Tier), see SAT Sovereign Authority & Operator Identity.

Aarkam SCT’s Identity & Access Management (IAM) tier enforces stringent enterprise security controls aligned with NCA ECC-2:2024 §2-2, NIST SP 800-63B, and ISO/IEC 27001:2022.

1. Multi-Factor Authentication (MFA / TOTP)

Aarkam enforces hardware or software TOTP Multi-Factor Authentication across all administrative and tenant-privileged access:

Algorithm: RFC 6238 Time-Based One-Time Password (TOTP)
Time Step: 30 seconds with 1-step drift tolerance
Enrollment: Secure QR-code provisioning with encrypted shared secrets for Microsoft Authenticator, Google Authenticator, and hardware YubiKeys.
Service Implementation: Implemented in IMfaService and required prior to generating API tokens or accessing administrative panels.

2. Password Governance & NIST Compliance

User authentication enforces strict cryptographic hygiene in AarkamPersistenceModule:

Policy	Setting	Standard Compliance
Minimum Length	12 characters minimum (configurable up to 64)	NIST SP 800-63B §5.1.1.2
Character Diversity	Uppercase, lowercase, digit, and special symbol mandatory	NCA ECC-2:2024 §2-2-3-1
Brute-Force Lockout	5 failed attempts triggers 15-minute progressive lockout	OWASP ASVS §2.2.1
Password Expiry	90-day forced rotation for privileged accounts	SAMA CSF §3.2.4
Historical Prevention	Cannot reuse the last 5 previous passwords	NCA ECC-2:2024 §2-2-3-2

3. Session Security & Concurrency Limits

Session management prevents concurrent hijackings and unauthorized credential re-use:

Idle Session Expiry: 15 minutes of inactivity automatically terminates administrative sessions.
Absolute Session Lifetime: 8 hours maximum duration, requiring re-authentication regardless of activity.
Concurrent Session Limit: Maximum of 2 active concurrent sessions per administrative user. Subsequent logins invalidate previous session tokens via epoch revocation.
Cookie Security Attributes: All authentication cookies are injected with SameSite=Strict, Secure, and HttpOnly flags.

4. Role-Based Access Control (RBAC) Hierarchy

Granular operational roles prevent lateral privilege escalation across sovereign tenant boundaries:

Role Identifier	Scope	Assigned Capabilities
`SuperAdmin`	Global System	Genesis bootstrap authority, KMS HSM master key management, raw storage pool partitioning, emergency cluster lockdown.
`TenantAdmin`	Tenant Namespace	Bucket creation, user account provisioning within tenant scope, IAM policy mapping, WORM Object Lock configuration.
`StorageOperator`	Physical Fabric	Storage node diagnostics, SMART telemetry inspection, offline disk maintenance windows, rebalance job tracking.
`SecurityAuditor`	Audit Plane	Read-only access to immutable WORM audit logs, compliance reports, cryptographic key rotation timestamps.
`S3User`	Bucket Data	SigV4 object upload, download, and multi-part streaming bounded strictly by tenant bucket ACLs.

← Previous Article

Sovereign Key Custody & HSM Integration (BYOK)

Zero-Egress Architecture & mTLS Mesh