Access
Who may sign in, which directory vouches for them, what they may reach once they are in, who is signed in at this moment, the duties that must not be combined, administrator authority borrowed for a fixed window, and one person’s identity borrowed for another to debug with.
11 steps · 7 questions · 9 screens on this shelf
The screens on this shelf
Workspace
Users
Who may sign in, which roles they hold, and where they are allowed to work.
Open
Workspace
Service Accounts
Identities for software. They hold roles like a person but cannot sign in to the console and are never asked for a second step: a secret, shown once, is exchanged for a short-lived token.
Open
Workspace
Roles
What a role may reach: modules, locations and warehouses.
Open
Workspace
Single Sign-On
One connection per directory — SAML 2.0 and OpenID Connect sign people in; OAuth 2.0, WS-Federation, CAS, LDAP and the rest are described — and the email domains each of them answers for, the directory’s MFA and the roles its groups give.
Open
Workspace
Provisioning (SCIM)
Your directory creates, changes and deactivates people here through SCIM 2.0, with a token made on this screen and shown once. Groups it pushes give the roles you choose.
Open
Workspace
Web & User Sessions
Every web session and every signed-in person, with what each is doing now. Sign out one, several, a person, or everybody else.
Open
Workspace
Segregation of Duties
Pairs of duties that should not sit with one person, and who currently holds both. Administrators are exempt — they hold every grant by definition.
Open
Workspace
Elevated Access
Administrator authority borrowed for a fixed window, against a written reason, a ticket and two approvals. It ends on its own.
Open
Workspace
Assumed Identity
Signing in as another person to reproduce their transaction, for a fixed window, against a written reason, a ticket and two approvals. Read-only unless it was approved otherwise, an administrator can never be the subject, and every call made with it is recorded and readable afterwards.
Open
Progress is kept in this browser only — it is not sent anywhere and nobody else can see it.