┌─────────────────────────────────────────────────────────────────────────────┐
│                    IAM COMPONENTS                                         │
├─────────────────────────────────────────────────────────────────────────────┤
│                                                                             │
│  ┌──────────────────────────────────────────────────────────────────────┐   │
│  │                    IDENTITY LIFECYCLE                               │   │
│  │  Onboarding → Management → Offboarding                              │   │
│  └──────────────────────────────────────────────────────────────────────┘   │
│                                    │                                        │
│                                    v                                        │
│  ┌──────────────────────────────────────────────────────────────────────┐   │
│  │                    AUTHENTICATION                                   │   │
│  │  Something You Know (password)                                     │   │
│  │  Something You Have (token, phone)                                 │   │
│  │  Something You Are (biometrics)                                    │   │
│  └──────────────────────────────────────────────────────────────────────┘   │
│                                    │                                        │
│                                    v                                        │
│  ┌──────────────────────────────────────────────────────────────────────┐   │
│  │                    AUTHORISATION                                    │   │
│  │  RBAC (Role-Based)                                                 │   │
│  │  ABAC (Attribute-Based)                                            │   │
│  │  PBAC (Policy-Based)                                               │   │
│  └──────────────────────────────────────────────────────────────────────┘   │
│                                    │                                        │
│                                    v                                        │
│  ┌──────────────────────────────────────────────────────────────────────┐   │
│  │                    GOVERNANCE & COMPLIANCE                          │   │
│  │  Access reviews, audits, reporting, compliance                     │   │
│  └──────────────────────────────────────────────────────────────────────┘   │
│                                                                             │
└─────────────────────────────────────────────────────────────────────────────┘

# ===================================================================
# MODULE 5, LESSON 2: IDENTITY AND ACCESS MANAGEMENT (IAM)
# ===================================================================

import pandas as pd
import numpy as np
import matplotlib.pyplot as plt
import seaborn as sns
import hashlib
import time
import hmac
import base64
import warnings
warnings.filterwarnings('ignore')

print("="*70)
print("IDENTITY AND ACCESS MANAGEMENT (IAM) IN DIGITAL BANKING")
print("="*70)

# ----------------------------------------------------------------
# PART A: AUTHENTICATION METHODS COMPARISON
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART A: Authentication Methods Comparison")
print("-"*60)

auth_methods = pd.DataFrame({
    'Method': ['Password', 'SMS OTP', 'Email OTP', 'Authenticator App', 
               'Hardware Token', 'Fingerprint', 'Face ID', 'Voice Recognition', 
               'Behavioural Biometrics'],
    'Security Level (1-5)': [2, 3, 2, 4, 5, 5, 5, 4, 4],
    'Convenience (1-5)': [4, 4, 3, 4, 2, 5, 5, 4, 5],
    'Cost (1-5)': [1, 2, 1, 2, 4, 3, 3, 3, 3],
    'Adoption Rate (%)': [95, 85, 70, 55, 20, 75, 70, 30, 15]
})

print("Authentication Methods Comparison:")
print(auth_methods.to_string(index=False))

# Visualise
fig, ax = plt.subplots(figsize=(12, 6))
auth_methods.plot(kind='bar', x='Method', y=['Security Level (1-5)', 'Convenience (1-5)'], ax=ax)
ax.set_ylabel('Score (1-5)')
ax.set_title('Authentication Methods: Security vs Convenience')
ax.legend(loc='best')
ax.tick_params(axis='x', rotation=45)
ax.grid(True, alpha=0.3)
plt.tight_layout()
plt.savefig('auth_methods.png', dpi=300, bbox_inches='tight')
plt.show()
print("Authentication methods visualisation saved as 'auth_methods.png'")

# ----------------------------------------------------------------
# PART B: SIMULATED MFA FLOW
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART B: Simulated MFA Flow")
print("-"*60)

def generate_otp(secret, counter):
    """Generate a time-based OTP (simulated)."""
    # Simple hash-based OTP simulation
    data = f"{secret}{counter}".encode()
    hash_obj = hashlib.sha256(data)
    otp = str(int(hash_obj.hexdigest()[:6], 16) % 1000000).zfill(6)
    return otp

def verify_otp(user_otp, secret, counter):
    """Verify OTP."""
    expected_otp = generate_otp(secret, counter)
    return user_otp == expected_otp

class MFASystem:
    """Simulate an MFA system."""
    
    def __init__(self):
        self.users = {}
        self.sessions = {}
    
    def register_user(self, user_id, password, secret):
        """Register a user with password and MFA secret."""
        self.users[user_id] = {
            'password': hashlib.sha256(password.encode()).hexdigest(),
            'mfa_secret': secret,
            'mfa_counter': 0
        }
        return f"User {user_id} registered"
    
    def authenticate(self, user_id, password, otp=None):
        """Authenticate a user."""
        if user_id not in self.users:
            return {'success': False, 'message': 'User not found'}
        
        user = self.users[user_id]
        
        # Verify password
        if user['password'] != hashlib.sha256(password.encode()).hexdigest():
            return {'success': False, 'message': 'Invalid password'}
        
        # Verify OTP (if provided)
        if otp is not None:
            user['mfa_counter'] += 1
            if not verify_otp(otp, user['mfa_secret'], user['mfa_counter']):
                return {'success': False, 'message': 'Invalid OTP'}
        
        # Create session
        session_id = hashlib.sha256(f"{user_id}{time.time()}".encode()).hexdigest()[:16]
        self.sessions[session_id] = {
            'user_id': user_id,
            'timestamp': time.time()
        }
        
        return {'success': True, 'session_id': session_id}

# Test MFA system
mfa_system = MFASystem()
mfa_system.register_user('alice', 'password123', 'SECRETKEY123')

# Test authentication without MFA
result = mfa_system.authenticate('alice', 'password123')
print(f"Authentication (without MFA): {result}")

# Test with MFA
otp = generate_otp('SECRETKEY123', 1)
result = mfa_system.authenticate('alice', 'password123', otp)
print(f"Authentication (with MFA): {result}")

# Test with invalid OTP
result = mfa_system.authenticate('alice', 'password123', '000000')
print(f"Authentication (with invalid MFA): {result}")

# ----------------------------------------------------------------
# PART C: ROLE-BASED ACCESS CONTROL (RBAC)
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART C: Role-Based Access Control (RBAC)")
print("-"*60)

# Define roles and permissions
roles = {
    'Customer': {
        'permissions': ['view_own_account', 'view_transactions', 'transfer_funds', 'manage_profile']
    },
    'Loan Officer': {
        'permissions': ['view_own_account', 'view_transactions', 'transfer_funds', 
                       'manage_profile', 'view_loan_applications', 'approve_loans']
    },
    'Branch Manager': {
        'permissions': ['view_own_account', 'view_transactions', 'transfer_funds', 
                       'manage_profile', 'view_loan_applications', 'approve_loans', 
                       'view_customers', 'approve_limits']
    },
    'IT Administrator': {
        'permissions': ['view_own_account', 'manage_users', 'manage_systems', 
                       'view_logs', 'manage_security', 'system_config']
    },
    'Compliance Officer': {
        'permissions': ['view_own_account', 'view_all_transactions', 'view_audit_logs', 
                       'compliance_reports', 'fraud_investigation']
    }
}

def check_permission(role, permission):
    """Check if a role has a specific permission."""
    if role not in roles:
        return False
    return permission in roles[role]['permissions']

# Test RBAC
test_cases = [
    ('Customer', 'approve_loans'),
    ('Loan Officer', 'approve_loans'),
    ('Branch Manager', 'approve_loans'),
    ('Customer', 'view_audit_logs'),
    ('Compliance Officer', 'view_audit_logs')
]

print("RBAC Permission Check:")
for role, permission in test_cases:
    has_permission = check_permission(role, permission)
    print(f"  Role '{role}' has '{permission}': {has_permission}")

# ----------------------------------------------------------------
# PART D: IAM GOVERNANCE DASHBOARD
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART D: IAM Governance Dashboard")
print("-"*60)

# Simulate IAM data
np.random.seed(42)
n_users = 1000

iam_data = pd.DataFrame({
    'user_id': range(1, n_users + 1),
    'role': np.random.choice(list(roles.keys()), n_users, p=[0.6, 0.15, 0.1, 0.05, 0.1]),
    'mfa_enabled': np.random.choice([0, 1], n_users, p=[0.2, 0.8]),
    'last_login': np.random.choice([datetime.now().strftime('%Y-%m-%d') for _ in range(30)], n_users),
    'active': np.random.choice([0, 1], n_users, p=[0.1, 0.9])
})

# Summary statistics
iam_summary = iam_data.groupby('role').agg({
    'user_id': 'count',
    'mfa_enabled': 'mean',
    'active': 'mean'
}).round(2)
iam_summary.columns = ['Count', 'MFA Adoption', 'Active Rate']

print("IAM Governance Dashboard:")
print(iam_summary)

# Visualise
fig, axes = plt.subplots(1, 2, figsize=(14, 5))

# Role Distribution
ax = axes[0]
role_counts = iam_data['role'].value_counts()
ax.pie(role_counts.values, labels=role_counts.index, autopct='%1.1f%%')
ax.set_title('User Role Distribution')

# MFA Adoption by Role
ax = axes[1]
mfa_by_role = iam_data.groupby('role')['mfa_enabled'].mean() * 100
ax.bar(mfa_by_role.index, mfa_by_role.values, color='teal', alpha=0.7)
ax.set_xlabel('Role')
ax.set_ylabel('MFA Adoption (%)')
ax.set_title('MFA Adoption by Role')
ax.tick_params(axis='x', rotation=45)
ax.axhline(y=80, color='red', linestyle='--', label='Target (80%)')
ax.legend()
ax.grid(True, alpha=0.3)

plt.tight_layout()
plt.savefig('iam_dashboard.png', dpi=300, bbox_inches='tight')
plt.show()
print("IAM dashboard visualisation saved as 'iam_dashboard.png'")

# ----------------------------------------------------------------
# PART E: PRIVILEGED ACCESS MANAGEMENT
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART E: Privileged Access Management (PAM)")
print("-"*60)

# Simulate privileged access
privileged_access = pd.DataFrame({
    'User': ['admin1', 'admin2', 'dev1', 'dev2', 'db_admin'],
    'Privileged Account': ['root', 'root', 'sudo', 'sudo', 'db_admin'],
    'Last Access': [datetime.now().strftime('%Y-%m-%d %H:%M') for _ in range(5)],
    'Access Type': ['System Admin', 'System Admin', 'Developer', 'Developer', 'Database Admin'],
    'Session Duration (min)': [45, 120, 180, 60, 30],
    'Risk Level': ['Medium', 'High', 'Medium', 'Low', 'High']
})

print("Privileged Access Management:")
print(privileged_access.to_string(index=False))

# ----------------------------------------------------------------
# PART F: IAM METRICS DASHBOARD
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART F: IAM Metrics Dashboard")
print("-"*60)

iam_metrics = pd.DataFrame({
    'Metric': [
        'MFA Adoption Rate',
        'Authentication Success Rate',
        'Access Request Fulfilment Time',
        'Privileged Access Compliance',
        'Identity Governance Score',
        'Password Policy Compliance',
        'Access Certification Completion',
        'Identity Lifecycle Compliance'
    ],
    'Current Value': [
        '78%',
        '96.5%',
        '4.2 hours',
        '72%',
        '82/100',
        '85%',
        '68%',
        '75%'
    ],
    'Target Value': [
        '> 95%',
        '> 99%',
        '< 2 hours',
        '> 95%',
        '> 90/100',
        '> 95%',
        '> 90%',
        '> 95%'
    ],
    'Status': ['🟡', '🟡', '🔴', '🔴', '🟡', '🟡', '🔴', '🟡']
})

print("IAM Metrics Dashboard:")
print(iam_metrics.to_string(index=False))

# ----------------------------------------------------------------
# PART G: IAM STRATEGY RECOMMENDATIONS
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART G: IAM Strategy Recommendations")
print("-"*60)

strategy = {
    "1. Multi-Factor Authentication": {
        "Actions": [
            "Implement MFA for all users.",
            "Offer biometric authentication options.",
            "Use risk-based authentication.",
            "Enable adaptive authentication."
        ],
        "Priority": "High",
        "Timeline": "0-6 months"
    },
    "2. Privileged Access Management": {
        "Actions": [
            "Implement PAM for all privileged accounts.",
            "Enforce least-privilege access.",
            "Monitor and record privileged sessions.",
            "Rotate privileged passwords regularly."
        ],
        "Priority": "High",
        "Timeline": "0-12 months"
    },
    "3. Identity Governance": {
        "Actions": [
            "Implement automated access certifications.",
            "Conduct regular access reviews.",
            "Automate identity lifecycle management.",
            "Implement role-based access control."
        ],
        "Priority": "Medium",
        "Timeline": "6-12 months"
    },
    "4. Single Sign-On": {
        "Actions": [
            "Implement SSO for all applications.",
            "Enable federated identity.",
            "Use SAML/OAuth for integration.",
            "Reduce password fatigue."
        ],
        "Priority": "Medium",
        "Timeline": "6-12 months"
    },
    "5. Compliance": {
        "Actions": [
            "Ensure GDPR and PCI DSS compliance.",
            "Implement audit logging and monitoring.",
            "Conduct regular IAM audits.",
            "Document IAM policies and procedures."
        ],
        "Priority": "High",
        "Timeline": "Ongoing"
    }
}

print("IAM Strategy Recommendations:")
for item, details in strategy.items():
    print(f"\n{item}:")
    for action in details['Actions']:
        print(f"  • {action}")
    print(f"  Priority: {details['Priority']}")
    print(f"  Timeline: {details['Timeline']}")

# ----------------------------------------------------------------
# PART H: SUMMARY AND RECOMMENDATIONS
# ----------------------------------------------------------------

print("\n" + "="*70)
print("PART H: Summary and Recommendations")
print("="*70)

print("""
Identity and Access Management – Key Takeaways:

1. IAM ensures the right people have access to the right resources.
2. Authentication: something you know, have, or are.
3. MFA is essential for securing access (password + OTP/biometric).
4. Authorisation: RBAC, ABAC, and PBAC control access.
5. PAM manages privileged accounts and sessions.
6. IAM governance: identity lifecycle, access certifications, reviews.
7. Regulatory compliance: GDPR, PCI DSS, PSD2 (SCA).

Recommendations:
  - Implement MFA for all users.
  - Use biometric authentication for mobile banking.
  - Implement PAM for privileged accounts.
  - Conduct regular access reviews and certifications.
  - Ensure compliance with regulatory requirements.
  - Automate identity lifecycle management.
""")

print("="*70)
print("END OF LESSON 2 – MODULE 5")
print("="*70)