Identity, SSO & MFA¶
CyberArmor secures portal access with enterprise SSO and multi-factor authentication, and enriches every recorded event with directory identity so audit trails, action graphs, telemetry, and incidents resolve to a real person.
Single sign-on (OIDC)¶
- generic OIDC Authorization Code flow with PKCE, available alongside email-code login
- configuration is stored tenant-scoped; the client secret is write-only and never returned
- works with any standards-compliant IdP (Entra ID, Okta, Ping, and others)
Just-in-time provisioning¶
Off by default. When enabled, a successful SSO login auto-creates a viewer-role account for anyone the IdP authenticates — never an admin. With JIT off, a user must already exist (created via invite) before SSO sign-in succeeds.
Configuration¶
| Endpoint | Audience |
|---|---|
GET/PUT /customer/sso |
tenant admin (self-service) |
GET/PUT /tenant-sso/{tenant_id} |
platform admin (on a tenant's behalf) |
Configure the IdP redirect/callback URL as https://<portal>/auth/sso/callback.
Multi-factor authentication¶
- RFC 6238 TOTP with authenticator-app enrollment and one-time backup codes
- per-user enrollment with a per-tenant "MFA required" flag
- TOTP secrets are encrypted at rest
Directory identity enrichment¶
The identity service enriches events with directory context from Microsoft
Entra ID, Okta, Ping Identity, and AWS IAM Identity Center. Enrichment resolves
an identifier to a display name, department, and group membership, and is cached
per (tenant_id, identifier) to prevent cross-tenant leakage.
Enrichment is applied to:
- audit events and the human/agent action graph
- telemetry records
- incidents and risk events
Validation checklist¶
PUT /customer/ssostores an OIDC config and never echoes the client secret- an SSO login with JIT enabled provisions a viewer-role account
GET /customer/me/totp/statusreflects per-user MFA enrollment- an audit or incident record shows a resolved user name and department, not a bare ID