Resources · Integration patterns
Secure identity and secret handling
Single sign-on with MFA, task-based roles, workload identity and a central store with rotation.
Integration status: Documented pattern
A documented pattern for client environments. In this platform: sessions with CSRF, MFA in the client portal and isolation through RLS.
Description
People sign in through an identity provider with MFA and temporary privileges; services get short-lived permissions through their own identity, and secrets live in a store with rotation and audit.
Prerequisites
- An identity provider.
- An inventory of accounts and keys.
- System owners.
When to use it
- Any environment with more than a few people.
- Keys in configuration files.
- Audit requirements.
When not to use it
- There is no such case — the only question is the scope of the first step.
Reference diagram
An illustration of the components and the flow — not a running system.
01People
- Single sign-on
- MFA
- Temporary privileges
02Services
- Workload identity
- Short-lived tokens
03Secrets
- Store
- Rotation
- Audit
The diagram as a list
| Stage | Components |
|---|---|
| People | Single sign-on, MFA, Temporary privileges |
| Services | Workload identity, Short-lived tokens |
| Secrets | Store, Rotation, Audit |
Security controls
- MFA for everyone and phishing-resistant sign-in for administrators.
- No long-lived keys.
- Audit of secret access.
Observability
- Failed sign-ins.
- Privilege use.
- Secret age.
Failure modes
| Failure | Mitigation |
|---|---|
| Leaked key | Rotation and detection in code repositories. |
| Leftover access | Automatic removal on leaving. |
| Privilege misuse | Temporary rights and logging. |