title: Implementing identity and access management backed by Stormpath
body: <p>We are planning to create an identity and access management system for one of our application and using Stormpath made a lot of sense interms of ROI, given that one of the decision is to have the IAM system abstract the Stormpath, so incase required we can replace it with an alternate(custom or another SaaS). </p>
  
  <p>Please let me know if the below flow is technically feasible. </p>
  
  <pre><code>Login) Client ---Password Grant--&gt; My IAM --Forward--&gt; Stormpath Server --Token--&gt; My IAM --Forward Token--&gt; Client
  
  Authorization) Client --Token--&gt; My IAM --Forward--&gt; Stormpath --Result--&gt; My IAM --Forward--&gt; Client(Success/Failed/Refresh)
  
  Logout) Client --Token--&gt; My IAM --Invalidate the Token--&gt;  Stormpath --Token invalidated--&gt; My IAM --Logged out--&gt; Client 
  </code></pre>
  
  <p>The Grant type as of now is going to be password_grant as we are authenticating our REST services and are not providing APIs for 3rd party applications</p>