Authentication & Identity

Who the user is, proven cryptographically, in a multi-tenant world. Pairs with 41 (what they're allowed to do).

Principals

• Tenant users — analysts/faculty inside one customer org. Authenticate against that tenant's configured IdP.
• Control-plane operators — insigz staff. Authenticate against the internal IdP with hardware MFA + IP allowlist (product §17 login).
• Service identities — ingestors, workers, the control plane → GCP service accounts (workload identity), not user auth.

Tenant user auth (B2B)

Each tenant is an organization with its own auth config:

• Enterprise SSO per tenant: SAML or OIDC to the customer's IdP (Okta/Azure AD/Google). Tenant discovery routes a login to the right IdP (by email domain or subdomain).
• SCIM (optional) for provisioning/deprovisioning seats from the customer's directory.
• JIT provisioning: first SSO login creates the user, mapped to a default role; group→role mapping configurable per tenant.
• Fallback local auth (email + password + TOTP) only where SSO isn't available; magic-link supported.

Use a managed auth provider (Auth0/WorkOS/Cognito/Firebase Auth) or build on an OIDC library — do not roll your own crypto. WorkOS/Auth0 give per-org SSO + SCIM out of the box, which is the bulk of B2B identity work.

Tokens & sessions

• On login, mint a short-lived JWT signed with the tenant's JWT key (Secret Manager, rotated). Claims: sub (user id), tid (tenant id), role, cell (wargame), exp, iat, jti.
• Refresh tokens are httpOnly+Secure cookies; rotate on use; revocable (store jti denylist in Redis).
• The JWT tid is the only trusted source of tenant identity server-side — never a header or query param the client controls.
• Session management surfaces "revoke from any device" (product parity).

The request → context bridge

Middleware verifies the JWT, then sets the DB session context that RLS reads:

SET LOCAL app.tenant_id = :tid;
SET LOCAL app.user_id   = :sub;
SET LOCAL app.role      = :role;
SET LOCAL app.cell      = :cell;   -- nullable

SET LOCAL scopes to the transaction so pooled connections don't leak context between requests.

MFA & step-up

• MFA required for control-plane operators (hardware key) and recommended/enforceable per tenant for users.
• Step-up auth for sensitive actions (publish a report, change roles, break-glass): re-prompt for MFA before the gate.

Gaps to close

• Pick the auth provider (WorkOS vs. Auth0 vs. build-on-OIDC) and whether SCIM is day-1.
• Define the group→role mapping contract per IdP and JIT defaults.
• Set JWT TTLs, refresh rotation, and the revocation store.