Auth provider integration
WorkOS/Auth0 - SAML - SCIM - MFA - session and device policy
Provider path
WorkOS
Auth0 alternative documented
Tenant
loanmeld-prod
org claim maps to active workspace
Access scopes
5
signed session grants enforced
Idle lock
5m
4-digit personal code
| Provider | Use | Capabilities | Integration state |
|---|---|---|---|
| WorkOS | Target | SSO, SAML, SCIM, admin portal | Organization mapping ready |
| Auth0 | Alternative | OIDC, SAML enterprise connections | Tenant claim mapping ready |
| Local headers | Development only | Cookie/header staff context | Blocked for production |
| Step | Milestone | Admin action | State |
|---|---|---|---|
| 1 | Choose provider | Select WorkOS or Auth0 per tenant and store provider org ID | Ready |
| 2 | Configure SAML/OIDC | Exchange metadata, callback URLs, signing certs, and claims | Next |
| 3 | Enable SCIM | Map directory groups to roles and test deprovisioning | Next |
| 4 | Enforce MFA | Require step-up for settings, exports, payments, and role changes | Policy |
| 5 | Cut over sessions | Replace local headers with signed provider sessions | Policy |
Current staff context
local sessions remain visible until signed provider sessions are enabled
Local Staff
staff@loanmeld.local
platform_adminlocal-default
| Policy | Value | Enforcement |
|---|---|---|
| Admin MFA | Required | all settings, export, payment, and role actions |
| Session max age | 12 hours | reauthenticate before next privileged action |
| Idle timeout | 5 minutes | lock operator shell and preserve draft state |
| Unlock code | 4 digits | required when resuming idle session |
| Trusted devices | 30 days | device-bound with revoke action |
| Cross-tenant access | Deny by default | tenant claim must match active workspace |
Session lock governance
tenant policy, employee unlock codes, device review, and audit evidence
| Employee | Unlock code | MFA | Last activity |
|---|---|---|---|
| Lin Parklin.park@example.test | Active4 digits | Required | May 3, 2026, 3:42 PM |
| Henry Walshhenry.walsh@example.test | Active4 digits | Required | May 3, 2026, 3:18 PM |
Session devices
trusted device review and revocation queue
| Actor | Device | State | Last seen |
|---|---|---|---|
| Lin Park | MacBook Pro - Charlotte | Trusted | 05/03/2026 09:42 PT |
| Henry Walsh | Windows workstation - Raleigh | Review | 05/02/2026 16:18 PT |
| Service account | API token worker | Restricted | 05/02/2026 02:10 PT |
SAML configuration
metadata fields required before SSO cutover
| Item | State | Requirement |
|---|---|---|
| Entity ID | Required | tenant-specific issuer and ACS URL |
| Metadata XML | Required | certificate, SSO URL, signature algorithm |
| Attribute mapping | Required | email, name, tenant, role groups |
| JIT provisioning | Approval | create staff record from signed assertion |
| Break-glass admin | Required | local emergency role with MFA evidence |
SCIM directory sync
directory objects mapped to tenant staff and roles
| Object | Attributes | Action |
|---|---|---|
| Users | email, displayName, active | Create, update, deactivate |
| Groups | externalId, displayName | Map to tenant roles |
| Role assignments | group membership | Sync privileged grants |
| Deprovisioning | active=false | Suspend sessions and API tokens |
Cutover evidence
controls that must be retained before provider enforcement
| Evidence | Status | Owner |
|---|---|---|
| MFA policy export | Ready | Security |
| Session lock review | Seeded | Admin |
| SCIM deprovision test | Next | Identity |