Authentication & Identity Hardening
Audience: Administrators, Platform Engineers, Security Officers
Time: ~10 min (overview)
Prerequisites: Control Plane deployed and reachable; Super Administrator access (your administrator account)
Control Core v3.4 strengthens how operators authenticate to the Control Plane: password hashing, breached-credential checks, hardened SAML/OIDC, passkeys, session lifecycle, and (in upcoming releases) SCIM provisioning and centralized revocation.
Overview
Authentication establishes who is using the Control Plane. Authorization over protected APIs and AI workloads still flows through your Bouncers and controls (Rego policies) — the Control Plane does not replace inline enforcement.
Use this guide set when you need to:
- Configure enterprise SSO (SAML 2.0 or OIDC)
- Enforce MFA and passkeys
- Tune password and session policy
- Plan SCIM-driven provisioning and fast deprovisioning
Compliance mapping
| Framework / requirement | Control Core capability | Guide |
|---|---|---|
| NIST 800-63B (memorized secrets) | Argon2id password hashing, breach check | Password policy |
| PCI DSS 8.x (authentication) | MFA, session timeout, lockout (rolling) | MFA & passkeys, Sessions |
| ISO 27001 A.5.15–A.5.18 | SSO, RBAC, session revoke, audit | SSO, Sessions |
| SOC 2 CC6.1 | Identity lifecycle, audit events | SCIM, User management |
| FedRAMP IA-2 / IA-5 | Phishing-resistant MFA (passkeys), IdP federation | MFA & passkeys |
Authentication methods
| Method | Control Plane UI path | Status |
|---|---|---|
| Username + password | Settings → Users → Authentication Methods | Available |
| TOTP MFA | Per-user enrollment; org-wide via AUTH_REQUIRE_MFA | Available |
| SAML 2.0 / OIDC SSO | Settings → Users → SSO | Available (hardened assertions) |
| Passkeys (WebAuthn/FIDO2) | Settings → Users → Passkeys | Available |
| SCIM 2.0 provisioning | API + IdP app | Available (release-dependent) |
Troubleshooting: If no authentication method works after upgrade, confirm at least one method is enabled under Authentication Methods, your administrator account can sign in, and the Control Plane API health endpoint returns HTTP 200. See Admin troubleshooting.
Deep-dive guides
- SSO with SAML & OIDC — federation, assertion hardening, JIT attributes
- MFA & passkeys — TOTP enforcement and FIDO2
- Password policy — Argon2id, breach check, rotation
- Session management — JWT lifetime, idle timeout, revocation
- SCIM provisioning — automated user lifecycle
Next steps
- Harden passwords and enable breach checking: Password policy
- Connect your corporate IdP: SSO with SAML & OIDC
- Review role assignments after SSO: User management