Building a Customer IAM system at Booking.com

A powerful and secure Identity and Access Management (IAM) system is key to any B2C business. Customer acquisition, confidence, retention and ultimately revenue from transactions is influenced and driven by customers' experience with account creation, login and overall feeling of having a secure identity.

One of the first projects I led when I joined Booking.com was to re-strategize and re-implement the existing Customer Identity and Access Management (CIAM) system. Given the two-sided marketplace nature of Booking's business, this meant rethinking IAM for end users and partners.

Booking's CIAM system was, at that point, a result of organic growth-driven evolution coupled with the distributed weak-ownership development model. This left a lot to be desired. Booking's business model also enabled users to book without creating or logging into their accounts.

After looking at the solution providers in the market and the unique requirements of Booking tech stack, and the preference for building (as opposed to buying) we decided to augment our existing implementation where possible and rebuild some of the foundational parts with the following guiding principles:

• Build to last (be future-proof), on standards
• Build for cross product and cross-brand (think OpenTable, Kayak etc.) use
• Build with a long-term plan and execute with short-term impact

Over the course of the next year or so, the team worked on various aspects of the CIAM, including:

• Two Factor Authentication (2FA) for end users
• Single Sign On (SSO) for business customer accounts
• SSO for partner accounts
• Delegated authentication support with OAuth
• Redesigned user experience across various products of Booking
• Improved call-back protocol procedures for partners

Developing a CIAM system for a very heavily data-informed business like Booking, which prides itself in its A/B testing based development culture and with a strong agile development mindset, of course presented interesting challenges and learnings but on the other hand, it provided us with a very short feedback loop that enabled us to validate our assumptions and field-test our implementations at a fast pace.

Did you know that the color of the "Sign in" button could have a big impact on the rate of sign-ins or that the copy text of the sign-in label could influence the failure rate of logins?

I did a talk covering various aspects of our work, with emphasis on identity management, at Consumer Identity World (Europe) event in 2018. You can find the slides of the talk that summarizes the key points. Without the voice-over, some nuances might be missing but I hope it still provides a good overview of the work.