Overview#
An IT security manager at a regional law enforcement agency discovers that twelve officers who transferred to a new unit six months ago still hold access rights from their previous assignments. Correcting that drift across five separate admin consoles would take most of a day. Identity Administration Workspace consolidates the entire identity control surface into one place: provider health, group-to-role mappings, provisioning status, and access risk are all visible and actionable from a single workspace.
Organisations in government, financial services, and critical infrastructure treat identity as an operational control system rather than a background configuration task. This module is built for that posture, bringing Keycloak, Zitadel, SCIM, SAML, and OIDC integrations under governed administration alongside tenant analytics and workforce lifecycle flows.
Key Features#
- Identity Governance Overview: Review tenant identity posture, provider health, provisioning status, and access risk from one admin view. Early warning signals surface before access failures disrupt operations.
- Provider Administration: Manage SAML, OIDC, SCIM, Keycloak, and Zitadel integrations through governed configuration and health workflows with status visibility across all connected providers.
- Group and Role Mapping: Map external identity groups to local roles and keep entitlement logic aligned with operational permissions. Drift detection alerts when external group structures change without corresponding local updates.
- Tenant and Workforce Sync: Coordinate tenant identity state and workforce lifecycle flows so onboarding, transfer, and off-boarding stay consistent across all connected systems.
- OAuth Client and Application Management: Control application registrations, federation clients, and trust relationships through a managed admin process with complete audit history.
- Invitation and Provisioning Workflows: Support invitations, bootstrap setup, and guided provisioning for new environments and operators, reducing manual account creation errors.
- Webhook and Event Administration: Manage identity-related event delivery for integrations, notifications, and downstream control systems.
- Identity Analytics and Health Monitoring: Track authentication patterns, provider health, and administrative signals that indicate drift or operational risk before they become incidents.
Use Cases#
- Enterprise Identity Governance: Run authentication, federation, and provisioning from a single administrative workspace rather than scattered console tabs.
- Provider Lifecycle Management: Add, update, and monitor external identity providers while preserving entitlement consistency across the estate.
- Tenant Onboarding and Expansion: Use guided provisioning and sync workflows to stand up new environments with clean identity administration from the first day.
- Operational Access Assurance: Detect mapping drift, unhealthy sync paths, or degraded provider posture before access failures disrupt operations.
Integration#
- Enterprise authentication, SSO, and MFA services with WCAG 2.2 AAA compliant admin interfaces
- Keycloak, Zitadel, SCIM, SAML, and OIDC federation workflows
- Tenant administration, invitations, analytics, and webhook services
- Role, permission, and workforce lifecycle management backed by PostgreSQL as the primary store
Open Standards#
- OpenID Connect (OIDC): Identity providers are federated and administered via OIDC discovery, token, and userinfo endpoints, supporting single sign-on and claims-based identity across Keycloak and Zitadel integrations.
- OAuth 2.0 (RFC 6749 / RFC 6750): Application registrations, federation clients, and service accounts are managed using OAuth 2.0 authorisation flows, bearer token issuance, and client credential grants.
- SAML 2.0 (OASIS): Enterprise federation providers are administered via SAML 2.0 entity metadata, SSO URLs, and X.509 certificate lifecycle tracking, with drift detection when provider metadata changes.
- SCIM 2.0 (RFC 7643 / RFC 7644): Workforce provisioning, group synchronisation, and off-boarding are coordinated through the System for Cross-domain Identity Management protocol, with per-organisation connection state persisted and audited.
- FIDO2 / WebAuthn (W3C / FIDO Alliance): Passwordless credential registration and synchronisation are managed through the FIDO2/WebAuthn standard, surfaced alongside other provider health signals in the administration workspace.
- GraphQL: All administrative queries, mutations, and analytics are exposed via a typed GraphQL API, enabling consistent, permission-gated access to identity state across all integrated providers.
- W3C WCAG 2.2 AAA: The administration interface meets WCAG 2.2 AAA conformance requirements, ensuring accessible keyboard navigation, screen-reader compatibility, and sufficient colour contrast for operators across all supported environments.
Last Reviewed: 2026-03-25 Last Updated: 2026-04-14