Provider registration
Register an HTTPS OIDC issuer, client, secret, and exact callback through a bearer-protected tenant route.
Federated workforce access with tenant-bound OIDC authorization-code login.
2AYE now implements OIDC discovery, exact issuer and audience validation, state, nonce, PKCE S256, signed ID-token validation, replay prevention, 2AYE session issuance, and audit evidence. Provider-specific certification and SAML are separate interoperability work and are not implied.
- Provider registration
- Fail-closed login
- Session control
What you can evaluate
OIDC SSO enforcement available in the platform API.
Fail-closed login
Reject issuer, audience, signature, lifetime, nonce, state, redirect, tenant, and replay failures.
Session control
Map the external subject to a tenant-bound workforce principal and issue a 2AYE session and authorization code.
Evidence
Record provider registration, login start, rejection, and completion without storing raw external subjects in audit data.
Follow Single sign-on from identity to evidence.
Each consequential action moves through the same six control points. See where 2AYE evaluates authority, requests human review, and preserves the outcome.
- 01IdentityWho or what is acting
- 02IntentSigned purpose and limits
- 03PolicyDeterministic evaluation
- 04ApprovalA named human when required
- 05ExecutionSingle-use grant, redeemed at the resource
- 06EvidenceReceipt joined to the audit chain
A practical adoption path
Start with one consequential workflow. Prove the boundary before expanding.
Assess
Document the environment, threat model, and integration boundary.
Design
Select protocols, signals, policies, and failure behavior.
Validate
Test vendor-specific APIs, tenant isolation, and abuse paths.
Release
Mark available only after deployed end-to-end verification.
What this includes
- OIDC discovery with exact issuer and audience validation
- State, nonce and PKCE S256
- Signed ID-token validation and replay prevention
- Tenant-bound session issuance and audit evidence