External Identity And Third-Party Auth

External identity support lets Eden accept bearer tokens from third-party identity providers while keeping Eden RBAC, endpoint grants, data-plane policy, and audit evidence as the enforcement layers.

Identity Providers

External auth is configured under [auth.external]. Eden validates OIDC tokens, resolves the organization and user, maps groups or claims into Eden permissions, and then runs the same control-plane and data-plane authorization checks used by local Eden tokens.

Provider presetRole
generic_oidcStandards-based OIDC issuer with explicit Eden organization mapping.
oktaOkta-compatible OIDC discovery and claim defaults.
microsoft_entraMicrosoft Entra ID tenant/user claim defaults, including tid, oid, and preferred_username.
google_workspaceGoogle OIDC tokens with configured Eden organization mapping.
auth0Auth0 OIDC tokens with static org mapping or custom claims.
aws_cognitoAWS Cognito OIDC tokens with cognito:groups and Cognito user defaults.
keycloakKeycloak OIDC tokens with realm-specific Eden mapping.
one_loginOneLogin OIDC tokens with Eden organization mapping.
ping_onePingOne OIDC tokens with Eden organization mapping.

Authorization Layers

LayerBehavior
Token validationVerifies issuer, audience, signature, expiration, and required claims.
Organization and subject resolutionResolves org_id, org_uuid, user_id, and user_uuid from static config or token claims.
Eden RBACApplies control-plane bits, shared data-plane bits, resource grants, and endpoint access.
Optional personal credentialsEndpoint-level security can route requests through personal credentials when configured.

External identities never bypass Eden RBAC. Group mappings and permission claims are inputs to Eden's existing authorization model.

Modes

ModeBehavior
disabledOnly local Eden authentication is accepted.
hybridLocal Eden tokens and configured external OIDC tokens are accepted. This is useful for staged rollout.
authoritativeBearer requests must validate against the configured external OIDC issuer. Local Basic Auth and local bearer tokens are rejected for API access.
Last updated: July 16, 2026