The identity, session, tenant model
How your identity becomes a tenant session, what the session allows, and why a tenant is a boundary.
Write a policy
The policy document (Effect, Actions, Resources), the tenant's managed policies and the sng tenant policy commands.
Attach a policy
Bind a policy to users, roles, machine applications or CI jobs with sng tenant policy attach.
Action catalog
For each sng command and each API route, the action and the resource checked by the tenant's policies.
Users of your applications
Manage the directory of your applications' users (invitation, open sign-up, passwordless sign-in, blocking, roles and permissions) from the console or with sng iam, and do not confuse it with your tenant's members.
Authentication for your applications
Entrust the sign-in of your applications' users to your tenant's OIDC issuer: declare an IAMApplication with directory tenant, read the sub, email, tenant, roles and permissions claims, verify the token, renew the secret.
Machine identities
Give an identity to a server or a script (client_credentials) or to a CI job, attach policies to it and obtain a tenant session.
Sign-in page
Style your users' sign-in page (logo, colors, theme, texts, links) and choose between invitation-only or open sign-up, from the console or with sng iam login-page.
Sign-in providers
Choose how your users sign in: link sent by email, Google, GitHub, GitLab, Microsoft, LinkedIn or OpenID Connect provider, declared with IAMProvider, credentials held in a secret.