A Multi-Tenant Identity Governance Model for Data Spaces Based on OpenID Connect

Data Spaces enable organizations to unlock the value of data through trusted and sovereign data sharing. Driven by initiatives such as the International Data Spaces Association (IDSA) and Gaia-X, Data Spaces have reached a sufficient level of maturity for industrial adoption, although key challenges remain. One of these challenges concerns identity management at the organization level. While Self-Sovereign Identity (SSI) provides a strong foundation for decentralized trust, its application in multi-tenant and cross-domain environments introduces significant access control and governance complexities. To address these challenges, this paper presents a multi-tenant identity governance model based on OpenID Connect (OIDC) that enforces a clear separation of roles. The practical applicability of the approach is demonstrated through an implementation using Keycloak, integrated with existing Data Space components, showing that the model can effectively support interoperable, secure, and controlled identity governance in Data Space environments.