SUIT - Security & Unified Identity Toolkit

SUIT (Security & Unified Identity Toolkit) is an enterprise-grade security and identity governance suite for Drupal 11, implementing Zero Standing Privileges (ZSP), Just-In-Time Privileged Identity Management (PIM), Session Shield & Step-Up Re-Authentication (PAM), and Separation of Duties (IAM).

Overview

Modern regulatory standards (ISO 27001 A.9, SOC 2 Type II, FedRAMP, DPDP 2023, and CERT-In Directions) mandate that enterprise systems eliminate permanent administrative privileges ("standing privileges") and enforce strict access governance, session isolation, and separation of duties.

SUIT provides a native, zero-external-dependency Drupal 11 architecture across three integrated modules:

1. SUIT IAM (Identity & Access Management - suit_iam)

• Separation of Duties (SoD) Engine: Define toxic role pairs (e.g., Billing Officer + Payment Approver, or Content Author + Content Publisher) that cannot be held concurrently. Enforces strict entity pre-save validation blocks and generates audit trails.
• Identity Lifecycle State Machine: Extends user identities with formal lifecycle states (Active, Suspended, Locked, Dormant, Offboarded).
• Automated Dormancy Engine: Cron worker scans for user accounts inactive past configurable thresholds (default 90 days), disables authentication, and logs compliance events.

2. SUIT PAM (Privileged Access Management - suit_pam)

• Privileged Session Shield: Configurable idle timeouts and strict IP/device binding checks for privileged accounts.
• Step-Up Re-Authentication: Route subscriber guarding sensitive administration endpoints (module installation, user permissions, role editing, and configuration synchronization). Requires fresh authentication before allowing high-impact changes.
• Dual-Custody Break-Glass Protocol: Emergency administrator elevation workflow requiring justification, security notification dispatch, and strictly time-boxed access.

3. SUIT PIM (Privileged Identity Management - suit_pim)

• Zero Standing Privileges (ZSP): Administrators do not hold permanent elevated roles in the database. Instead, users are designated as "Eligible".
• Just-In-Time (JIT) Elevation: Eligible users request temporary elevation with business justification, optional ticket/incident ID, and requested duration (1 to 8 hours).
• Multi-Approver Workflows: Configurable self-approval (with mandatory audit logging) or dual-custody peer approval workflows.
• Automated Revocation: Cron worker revokes elevated roles the moment an approved elevation window expires.

Core Audit Trail (suit)

Every elevation request, approval, denial, session invalidation, SoD conflict, and dormancy transition is logged to an immutable audit ledger (suit_audit_event) with actor, target, timestamp, IP address, severity level, and JSON metadata context.

Security & Standards

Architected natively for Drupal 11 with 100% PHPStan Level 6 clean typing, strict PHPCS Drupal & DrupalPractice compliance, and comprehensive PHPUnit Kernel test coverage.