Primary speaker:
Frank Boshoff, Assistant Director, Technical Solutions & Architecture, EASI
Additional speakers:
Andre Kalamandeen, Manager, Data, Architecture & Integration, EASI
Zoe Wong, Java Developer, EASI
Description:
Many university systems that host Master Data Records — such as ROSI and HRIS — create a new person record with a local identifier (student number, employee number) and then send key attributes to UTORauth, which mints a UTORid. This “create first, reconcile later” pattern produces hundreds of duplicate identities each year, driving significant administrative clean-up and a poor experience for people who end up with multiple IDs.
This talk showcases a new identity-minting architecture that aims to prevent duplication at the source by changing the order of operations. Instead of creating a local record and then requesting a university ID, applications will first check whether an identity already exists. Using attributes such as full legal name and date of birth (and optionally additional fields where available), an application calls a API to find an existing match. If a match is found, the existing ID is returned. If no match is found, a new ID is minted and returned. This can be invoked in real time or as part of batch processing, enabling adoption across different operational models.
A foundational change enabling this approach is that a new UUIDv7–based identifier is coming — intended to be used broadly across the university, including for AI agents as first-class actors. This ID becomes the stable anchor for identity, while key attributes are attached and managed in a Universal Profile repository with immutable records. Attributes may include UTORid, primary and secondary email addresses, Microsoft 365 / Entra ObjectID and legal names, among others.
The model establishes clear responsibilities: applications that need to create accounts must check the Universal Profile first, and applications that create or update identities are expected to publish updates back to keep the Universal Profile current. Access to these services is secured through Entra ID using OAuth 2.0, supporting standardized, least-privilege integration.
This proof of concept reduces duplicates, simplifies onboarding flows and creates an extensible identity foundation for people, services and agents.
