DRESS CODE Migrates to Secure, Scalable Authentication Infrastructure

Dress Code Inc. (Headquartered in Chuo-ku, Tokyo; CEO: Yuki Ejiri) has migrated DRESS CODE's authentication infrastructure to a dedicated, independent environment and implemented an authentication design based on the guidelines of the National Institute of Standards and Technology (NIST).

By moving away from a dependency on third-party SaaS-based authentication, the new infrastructure supports SSO integration via OIDC/SAML, multi-factor authentication (MFA) using authenticator apps (TOTP), and step-up authentication for critical operations. It also enables flexible control over the region where authentication data is stored and seamless integration with internal identity management systems—delivering the security, compliance, and scalability that enterprise organizations demand.

Background

As enterprise adoption of SaaS continues to grow, security requirements have become increasingly stringent year over year. For large enterprises and publicly listed companies in particular, the following requirements have become critical factors in whether a solution can be adopted:

• Integration with existing internal identity infrastructure such as Microsoft Entra ID (formerly Azure AD)
• Support for stronger MFA methods, including authenticator apps (TOTP) and biometric authentication (WebAuthn)
• Step-up authentication that requires additional verification only for critical operations, balancing security with usability

Traditional SaaS-based authentication platforms were often unable to fully address these highly specific and demanding requirements. In response, DRESS CODE adopted a globally recognized open-source identity platform and migrated its authentication infrastructure to a dedicated, independent environment—enabling flexible alignment with the strict security policies and compliance requirements of individual enterprises.

What the New Authentication Infrastructure Enables

SSO (OIDC / SAML) Support

OIDC/SAML integration enables connectivity with existing internal identity providers, including Microsoft Entra ID, Google Workspace, Okta, and Auth0. This allows customer organizations to adopt DRESS CODE seamlessly without significantly changing their existing login operations.

Risk-Based Step-Up Authentication

The new authentication design is based on the Authentication Assurance Level (AAL) framework defined by NIST. Standard operations maintain a convenient login experience (equivalent to AAL1), while sensitive actions—such as accessing My Number information or changing subscription plans—dynamically trigger MFA (equivalent to AAL2). This approach optimizes the balance between strong security and user productivity.

Support for Diverse MFA Methods

Organizations can choose from the following robust authentication methods based on their security policy:

• Passwordless authentication: Touch ID / Face ID (WebAuthn-compatible)
• App-based authentication: Google Authenticator and similar apps (TOTP)
• SMS authentication

Multiple Email Address Linking

By allowing multiple email addresses to be linked to a single account, this design addresses practical challenges such as preventing account loss during staff changes or employee departures, and enabling more flexible identity management.

External Identity Provisioning

Looking ahead, DRESS CODE plans to offer an external identity provisioning capability—enabling partner companies to log in using their DRESS CODE credentials. This reflects a broader vision of evolving the authentication infrastructure from a core product component into a platform that drives business expansion.