Per-tenant SSO: sign in with your corporate identity provider
Connect Dependra to your organisation's OIDC identity provider with real id-token signature validation via the IdP's JWKS — and let group-based claims mapping re-evaluate each user's role and stewardship grants on every login.
What it is
Dependra acts as an OIDC relying party against your corporate identity provider: discovery → authorize → callback → token exchange, with real id-token signature validation via the IdP's JWKS, and issuer, audience, lifetime and nonce checks. This isn't a flag that trusts a claim — it's a proper relying-party flow.
Client secrets and state are AES-256-GCM-encrypted. The SPA handoff uses a fragment-based one-time ticket, so the token never appears in a URL. Email-domain claiming is first-come-first-owns, proven by a validated login. A platform break-glass can disable a tenant's SSO if needed.
How it works
- Configure your IdP. Point Dependra at your OIDC discovery endpoint; client secrets are stored AES-256-GCM-encrypted.
- Validate at login. The id-token signature is verified against the IdP's JWKS, with issuer / audience / lifetime / nonce checks.
- Hand off safely. A fragment-based one-time ticket delivers the session to the SPA — the token never lands in a URL.
- Re-evaluate access. Group-based claims mapping recomputes each user's role and stewardship grants on every login.
The outcome
One corporate identity
Your people sign in with the IdP you already run — no separate Dependra password to provision or deprovision.
Access that stays current
Role and stewardship grants are re-derived from IdP groups on every login, so leavers and movers are reflected without manual edits.
Encrypted, ticket-based handoff
AES-256-GCM secrets and a one-time-ticket SPA handoff keep tokens out of URLs and logs.
Bring your own identity provider
Per-tenant SSO is part of the Enterprise tier. Talk to us about wiring Dependra into your IdP, or start a trial to explore the platform first.
View pricing