<![CDATA[Single Sign-On (SSO) in higher education generally centralizes authentication but does not resolve institutional identities heterogeneously represented across applications. At STMIK AKI, an individual is represented by email in the admission system, NIM in SIAKAD, NIDN/NPP in other systems, LMS accounts, and library numbers. Roles also vary by application context and identifiers change throughout the student lifecycle.This study designs an Identity-Aware SSO architecture integrating centralized authentication with institutional identity resolution, heterogeneous identifier mapping, lifecycle continuity, cross-application account binding, contextual role mapping, and conflict handling. Adopting Design Science Research, the study conducts system evidence mapping, literature gap analysis, design requirements derivation, conceptual modeling, architectural design, and traceability with evaluation design.The result separates Keycloak as the authentication and token provider from the Identity Resolution Service, positioning Institutional Identity as the canonical identity. Contributions include principles of canonical identity, identity continuity, contextual authorization, heterogeneity isolation, and conservative resolution. Implementation and empirical evaluation are reserved for future work. ]]>
Copyrights © 2026
