Features

External Identity And Third-Party Auth

External identity support lets Eden accept bearer tokens from third-party identity providers while keeping Eden RBAC, endpoint grants, data-plane policy, and audit evidence as the enforcement layers.

Identity Providers

External auth is configured under [auth.external]. Eden validates OIDC tokens, resolves the organization and user, maps groups or claims into Eden permissions, and then runs the same control-plane and data-plane authorization checks used by local Eden tokens.

Provider preset	Role
`generic_oidc`	Standards-based OIDC issuer with explicit Eden organization mapping.
`okta`	Okta-compatible OIDC discovery and claim defaults.
`microsoft_entra`	Microsoft Entra ID tenant/user claim defaults, including `tid`, `oid`, and `preferred_username`.
`google_workspace`	Google OIDC tokens with configured Eden organization mapping.
`auth0`	Auth0 OIDC tokens with static org mapping or custom claims.
`aws_cognito`	AWS Cognito OIDC tokens with `cognito:groups` and Cognito user defaults.
`keycloak`	Keycloak OIDC tokens with realm-specific Eden mapping.
`one_login`	OneLogin OIDC tokens with Eden organization mapping.
`ping_one`	PingOne OIDC tokens with Eden organization mapping.

Authorization Layers

Layer	Behavior
Token validation	Verifies issuer, audience, signature, expiration, and required claims.
Organization and subject resolution	Resolves `org_id`, `org_uuid`, `user_id`, and `user_uuid` from static config or token claims.
Eden RBAC	Applies control-plane bits, shared data-plane bits, resource grants, and endpoint access.
Optional personal credentials	Endpoint-level security can route requests through personal credentials when configured.

External identities never bypass Eden RBAC. Group mappings and permission claims are inputs to Eden's existing authorization model.

For an explicit, provider-specific authorization check after this baseline identity and RBAC flow, see AWS IAM External Permission Checks. It uses a selected AWS IAM principal as evidence for a saved-template policy simulation; it does not turn an external claim into an automatic Eden grant.

Signed Device Posture

Managed VPN access policies can require posture supplied by the verified OIDC token. The claim name defaults to eden_device_posture; set auth.external.device_posture_claim to another claim name, or to no value to disable ingestion.

json

{
  "eden_device_posture": {
    "platform": "macos",
    "client_version": "1.4.0",
    "managed": true,
    "disk_encrypted": true,
    "screen_lock": true,
    "endpoint_protection": true,
    "observed_at_epoch_seconds": 1774454400
  }
}

Eden trusts this object only after signature, issuer, audience, and token-expiry validation. A malformed configured posture claim fails authentication, and a VPN enrollment request cannot override it. Configure the identity provider or device-management integration to issue these values, then set the VPN policy's required attributes and freshness window.

Modes

Mode	Behavior
`disabled`	Only local Eden authentication is accepted.
`hybrid`	Local Eden tokens and configured external OIDC tokens are accepted. This is useful for staged rollout.
`authoritative`	Bearer requests must validate against the configured external OIDC issuer. Local Basic Auth and local bearer tokens are rejected for API access.

Configure the provider and tenant mapping:

toml

[auth.external]
mode = "authoritative"
provider = "okta"
issuer = "https://customer.okta.com/oauth2/default"
audience = "api://eden"
org_id = "customer-prod"
org_uuid = "00000000-0000-0000-0000-000000000001"
user_id_claim = "email"
groups_claim = "groups"
jwks_cache_ttl_secs = 300

[[auth.external.group_control_perms]]
group = "eden-admins"
perms = "RCPGDA"

[[auth.external.group_data_perms]]
group = "eden-engineers"
perms = "rw"

The service validates this configuration at startup. Once active, an accepted external bearer token resolves to the configured organization and the same Eden RBAC evaluation used for native identities.

Fail-Closed Trust Discovery

Configure the canonical HTTPS issuer rather than a redirecting alias. Eden requires the issuer, any explicit jwks_url, and the discovered jwks_uri to use HTTPS without embedded credentials or URL fragments. Issuer URLs also cannot include query parameters.

OIDC discovery must report an issuer value that exactly matches auth.external.issuer. Discovery and JWKS requests use a three-second connect timeout, a five-second total timeout, do not follow redirects, and reject responses larger than 1 MiB. Allow direct network egress to both provider metadata endpoints.

jwks_cache_ttl_secs defaults to 300 seconds and accepts values from 1 through 3,600. An unknown signing-key ID forces one immediate refresh for normal key rotation. Eden denies authentication on fetch, status, metadata, parsing, or expired-cache failure; it does not continue trusting stale keys.

Eden validates permission strings, group mappings, the static organization UUID, and remote URLs at startup. Invalid control-plane bits, data-plane bits, blank groups, or insecure provider URLs prevent the service from starting with an unsafe trust configuration.