Identity & SSO
Connect enterprise sign-in concepts to governed workforce-record access. Identity confirms who is signing in; permissions determine which workforce records and actions that person may use. Availability and supported methods depend on a verified deployment.
Identity answers
Who is signing in?
TEMVERIS answers
What may they see and do?
Try it: who's signing in?
Illustrative — not a live sign-in
- Authenticated
1 · Identity provider authenticates
Your organization's IdP confirms who is signing in
- Linked
2 · Tenant & identity link resolved
Verified mapping to one internal principal
- Authorized
3 · Role and purpose authorize
TEMVERIS decides what this person may use
Approver · Example
Signed inReviews and approves for assigned teams.
- View own record
- Review assigned teams
- Approve
- Configure IdP
- Edit policy
- Export
- Inspect audit
Three steps — and only
one of them is sign-in.
Identity authenticates; TEMVERIS applies tenant, role and record-level authorization. Supported connection methods depend on deployment and approval.
Authenticate the principal
Your identity provider confirms who is signing in.
Resolve tenant and identity link
The sign-in maps to one verified internal principal within one tenant.
Authorize scoped role and purpose
Permissions decide which records and actions that person may use.
Signing in is not the same
as access to a record.
Conceptual flow. No tokens, assertions, keys or tenant secrets are ever shown in public UI.
Identity provider
Your organization's system confirms the person.
Authentication result
Signed, issuer- and audience-validated.
TEMVERIS session
Linked to one internal principal.
Tenant / role decision
Scope and purpose are checked.
Approved record action
Only what the role permits.
What exists, and
how sure we are.
Each capability is marked Proposed, Conditional, Requires verification, Verified or Unsupported — never “live” by default.
Single sign-on
MFA via your IdP
Provisioning
Lifecycle (joiner / mover / leaver)
Session management
Access audit
Standards you may ask about.
Shown as evaluation examples only, subject to a signed standards register. No vendor badges or certification is implied.
SAML 2.0
Commonly used for enterprise web sign-in with signed assertions.
OIDC
A sign-in layer on OAuth 2.0; state, nonce and PKCE where applicable.
SCIM
A standard for creating, updating and deprovisioning users.
Who can do what — once they’re signed in.
Illustrative role model; exact permissions are configured and verified per deployment. Denied cells are shaded.
| Actor role | VIEW OWN RECORD | REVIEW ASSIGNED TEAMS | APPROVE | CONFIGURE IDP | EDIT POLICY | EXPORT | INSPECT AUDIT |
|---|---|---|---|---|---|---|---|
| End user | Allowed | Denied | Denied | Denied | Denied | Denied | Denied |
| Approver | Allowed | Allowed | Allowed | Denied | Denied | Denied | Denied |
| Payroll reviewer | Allowed | Allowed | Denied | Denied | Denied | Allowed | Denied |
| HR admin | Allowed | Allowed | Denied | Denied | Allowed | Denied | Denied |
| Identity admin | Denied | Denied | Denied | Allowed | Denied | Denied | Allowed |
| Security admin | Denied | Denied | Denied | Denied | Denied | Denied | Allowed |
| Auditor | Denied | Denied | Denied | Denied | Denied | Denied | Allowed |
Never link the wrong person.
An immutable internal subject is mapped to one external issuer within one tenant. Duplicates and mismatches go to manual review — never auto-merged.
| FIELD | PURPOSE |
|---|---|
| tenant_id | Tenant boundary |
| issuer_id | Which IdP issued it |
| external_subject_hash | Redacted external identity |
| internal_principal_id | Immutable TEMVERIS subject |
| link_status | Linked, conflict or reconciliation required |
| verified_at | When the link was verified |
| mapping_version | Which mapping applied |
Access follows the
person’s changing role.
Every change re-evaluates authorization. HR remains the owner of worker master data; signing in never changes it.
Conceptual controls, confirmed per deployment.
Logout behavior differs between the app session and your IdP session; it is explained only per verified protocol.
Assertion validation
Signature, issuer and audience checked.
Step-up MFA
Assisted by your IdP where configured.
Session expiry
Timeouts end idle sessions.
Session revocation
Access removal takes effect promptly.
Key rotation
Certificates and keys rotate on schedule.
Policy enforcement
Your sign-in policy applies consistently.
Fail closed. Never
bypass sign-in.
| CASE | WHAT THE PERSON SEES |
|---|---|
| Locked or unsupported IdP | "Sign-in isn't available for this account. Contact your organization's administrator." |
| Expired certificate | "Sign-in is temporarily unavailable. Contact your organization's administrator." |
| Replay or clock skew | "We couldn't complete sign-in. Please try again." |
| IdP outage | "Your sign-in service isn't responding. Try again later." |
| Misconfiguration | "Sign-in isn't configured correctly. Contact your organization's administrator." |
Recovery is restricted to delegated administrators through a verified channel. Messages never reveal account or tenant details.
Every access decision leaves a trace.
Evidence fields: actor, action, tenant, reason, timestamp, policy version, decision and correlation ID. Subject identifiers are redacted. Event names are illustrative.
Identity admin · reason recorded
Security admin
Subject redacted
Role and scope recorded
Before and after state recorded
Qualify the deployment
before go-live.
A reading aid only — nothing is saved.
Identity
questions,
answered.
Bring your security team to the conversation.
Review sign-in, role scoping, lifecycle and audit requirements with TEMVERIS. No identity-provider setup happens through this website.