🏗️ Password Generation at Scale: Patterns for IAM Provisioning Pipelines

Password Generation at Scale: Patterns for IAM Provisioning Pipelines

When your Identity and Access Management system needs to provision thousands of users, password generation must be consistent, cryptographically secure, and fully automated. This guide covers architectural patterns for IAM provisioning pipelines. For teams managing credentials at scale, 1Password provides a central vault for all provisioned secrets across environments.

Batch Generation Pattern

The simplest pattern for bulk provisioning: generate all passwords upfront, import them into the IAM system, and force a change on first login.

import secrets
import string
import csv

def generate_password(length=16):
    chars = string.ascii_letters + string.digits
    return ''.join(secrets.choice(chars) for _ in range(length))

def batch_provision(users_csv, output_csv):
    with open(users_csv) as inf, open(output_csv, 'w', newline='') as outf:
        reader = csv.DictReader(inf)
        writer = csv.writer(outf)
        writer.writerow(['username', 'password', 'must_change'])
        for row in reader:
            password = generate_password()
            writer.writerow([row['username'], password, 'true'])

Streaming Generation Pattern

For very large batches (10,000+ users), generate passwords on-demand rather than pre-computing all of them to avoid holding plaintext passwords in memory.

Hybrid Cloud Pattern

When provisioning spans on-prem AD and cloud IDPs (Azure AD, Okta), use a unified pipeline that generates once and maps to each target system's schema.

The Notification Pipeline

After generation, users must receive their credentials securely. Common patterns include:

• Self-service portal: User clicks "claim account" and sets their own password
• HR-distributed envelopes: HR delivers passwords through existing onboarding channels
• SMS/email fragments: Send partial credentials through different channels

Rate Limiting and Throttling

IAM systems have rate limits. Batch imports should respect these:

• AD: 50-100 users per batch with 30-second pauses
• Azure AD: 500 users per bulk operation
• Okta: 10 API requests per second for standard plans