thygon

Identity & Access Control

Let users and organizations authenticate, manage identities, and enforce permissions.

Implement this subsystem (opens in a new tab)

Enterprise Connections

These entities connect an organization to the identity infrastructure it already runs.

Entities

  • SSO Connection: An organization's SAML or OpenID Connect configuration for its identity provider.
  • Directory Connection: An organization's SCIM or directory synchronization configuration.
  • Provisioned User: A user created or updated by the customer's directory.
  • Group Mapping: A rule that translates a directory group into roles or teams.

Model

Rendering diagram…

Diagram source
erDiagram
  ORGANIZATION ||--o{ SSO_CONNECTION : configures
  ORGANIZATION ||--o{ DIRECTORY_CONNECTION : configures
  DIRECTORY_CONNECTION ||--o{ PROVISIONED_USER : syncs
  DIRECTORY_CONNECTION ||--o{ GROUP_MAPPING : applies
  GROUP_MAPPING }o--|| ROLE : grants

Key Rules

  • Connections belong to one organization. An identity provider can only sign users in to the organization that configured it.
  • Deprovisioning takes effect promptly. A user removed from the directory loses access, and their sessions end.
  • Signing certificates expire. Track expiry dates, and support rotation without downtime.

Implementation

Implement this subsystem

Implementation starts with technical scoping. We review your existing architecture, agree on boundaries, interfaces, and acceptance criteria, and adapt this design to fit before committing to delivery milestones.

There is no off-the-shelf package or fixed price: scope, timeline, and cost follow from that alignment.

Implement this subsystem (opens in a new tab)