Identity & SSO

Shipped identity integrations

Provider	Protocols	Go to
Azure AD (Entra ID)	OIDC + SAML	Azure AD
Google Workspace	OIDC	Google Workspace
Okta	SAML 2.0	Okta
OneLogin, JumpCloud, generic IdPs	SAML 2.0	SAML 2.0

Two distinct flows

Human login (SSO)

Users sign in via SSO → TapPass issues a session → session is used to administer the platform (manage agents, view audit trail, set policy).

User → TapPass → IdP → TapPass → dashboard session

The OIDC flow is /sso/login → IdP → /sso/callback → POST /sso/exchange. The SAML flow is /saml/login → IdP → POST /saml/acs.

Workload identity (developer keys)

Agents authenticate with per-agent developer keys (tp_...) — scoped, revocable, and audited per agent.

Agent (tp_ key) → TapPass → verifies key → agent identity on every call

Why federate

• Domain allowlist — only users with corporate email can log in.
• Group / role mapping — SAML assertion groups map to TapPass roles.
• Session hygiene — session lifetime follows IdP policy (MFA, re-auth).
• Offboarding — deactivate in IdP; the user can’t mint new sessions.

Not yet supported

• Okta OIDC — use Okta SAML instead. Built-in OIDC is Google and Azure only.
• LDAP / Active Directory (direct bind) — use an IdP (Entra ID, Okta) in front of LDAP instead.