Skip to content

Identity, SSO & MFA

CyberArmor.AI secures portal access with enterprise SSO and multi-factor authentication, and enriches every recorded event with directory identity so audit trails, action graphs, telemetry, and incidents resolve to a real person.

Single sign-on (OIDC)

  • generic OIDC Authorization Code flow with PKCE, available alongside email-code login
  • configuration is stored tenant-scoped; the client secret is write-only and never returned
  • works with any standards-compliant IdP (Entra ID, Okta, Ping, and others)

Just-in-time provisioning

Off by default. When enabled, a successful SSO login auto-creates a viewer-role account for anyone the IdP authenticates — never an admin. With JIT off, a user must already exist (created via invite) before SSO sign-in succeeds.

Configuration

Endpoint Audience
GET/PUT /customer/sso tenant admin (self-service)
GET/PUT /tenant-sso/{tenant_id} platform admin (on a tenant's behalf)

Configure the IdP redirect/callback URL as https://<portal>/auth/sso/callback.

Multi-factor authentication

  • RFC 6238 TOTP with authenticator-app enrollment and one-time backup codes
  • per-user enrollment with a per-tenant "MFA required" flag
  • TOTP secrets are encrypted at rest

Directory identity enrichment

The identity service enriches events with directory context from Microsoft Entra ID, Okta, Ping Identity, and AWS IAM Identity Center. Enrichment resolves an identifier to a display name, department, and group membership.

Each lookup goes only to the requesting tenant's own directory. A directory configured on the identity service through environment variables belongs to exactly one tenant, named by IDENTITY_PLATFORM_PROVIDERS_TENANT; the service refuses to start if a directory is configured without it, and a lookup for any other tenant answers "no provider for this tenant". The control plane's cache is also keyed by (tenant_id, identifier). A directory that cannot be reached yields no enrichment rather than an empty group list.

Enrichment is applied to:

  • audit events and the human/agent action graph
  • telemetry records
  • incidents and risk events

Validation checklist

  • PUT /customer/sso stores an OIDC config and never echoes the client secret
  • an SSO login with JIT enabled provisions a viewer-role account
  • GET /customer/me/totp/status reflects per-user MFA enrollment
  • an audit or incident record shows a resolved user name and department, not a bare ID