External Identity And Third-Party Auth
External identity support lets Eden accept bearer tokens from third-party identity providers while keeping Eden RBAC, endpoint grants, data-plane policy, and audit evidence as the enforcement layers.
Identity Providers
External auth is configured under [auth.external]. Eden validates OIDC tokens, resolves the organization and user, maps groups or claims into Eden permissions, and then runs the same control-plane and data-plane authorization checks used by local Eden tokens.
| Provider preset | Role |
|---|---|
generic_oidc | Standards-based OIDC issuer with explicit Eden organization mapping. |
okta | Okta-compatible OIDC discovery and claim defaults. |
microsoft_entra | Microsoft Entra ID tenant/user claim defaults, including tid, oid, and preferred_username. |
google_workspace | Google OIDC tokens with configured Eden organization mapping. |
auth0 | Auth0 OIDC tokens with static org mapping or custom claims. |
aws_cognito | AWS Cognito OIDC tokens with cognito:groups and Cognito user defaults. |
keycloak | Keycloak OIDC tokens with realm-specific Eden mapping. |
one_login | OneLogin OIDC tokens with Eden organization mapping. |
ping_one | PingOne OIDC tokens with Eden organization mapping. |
Authorization Layers
| Layer | Behavior |
|---|---|
| Token validation | Verifies issuer, audience, signature, expiration, and required claims. |
| Organization and subject resolution | Resolves org_id, org_uuid, user_id, and user_uuid from static config or token claims. |
| Eden RBAC | Applies control-plane bits, shared data-plane bits, resource grants, and endpoint access. |
| Optional personal credentials | Endpoint-level security can route requests through personal credentials when configured. |
External identities never bypass Eden RBAC. Group mappings and permission claims are inputs to Eden's existing authorization model.
Modes
| Mode | Behavior |
|---|---|
disabled | Only local Eden authentication is accepted. |
hybrid | Local Eden tokens and configured external OIDC tokens are accepted. This is useful for staged rollout. |
authoritative | Bearer requests must validate against the configured external OIDC issuer. Local Basic Auth and local bearer tokens are rejected for API access. |
Related Docs
Last updated: July 16, 2026