security
2026-04-13Sovereign Identity Service
Federated identity management with SAML 2.0, OIDC, and hardware key support for zero-trust architectures.
identity
saml
oidc
zero-trust
Overview
Aegis Sovereign uses OpenID Connect (OIDC) with PKCE as its sole authentication mechanism — no passwords are stored in the database. The backend validates the RS256 JWT against your IdP's JWKS endpoint. Supported providers: Azure AD, Okta, Auth0, Google Workspace, Ping Identity, Keycloak.
Identity Providers
Configure external identity providers for single sign-on.
| Provider | Protocol | Status |
|---|---|---|
| Azure Active Directory | OIDC / SAML | GA |
| Okta | OIDC / SAML | GA |
| Auth0 | OIDC | GA |
| Google Workspace | OIDC | GA |
| Keycloak (bundled) | OIDC | GA |
| PingFederate | SAML | Beta |
Configuration
Register an IdP config via the API. The login page automatically renders one SSO button per active config.
bash
1curl -X POST https://sovereign.yourcompany.com/api/v1/idp/configs \
2 -H "Authorization: Bearer $ADMIN_TOKEN" \
3 -H "Content-Type: application/json" \
4 -d '{
5 "org_id": "acme-corp",
6 "display_name": "Sign in with Okta",
7 "oidc_issuer": "https://acme.okta.com/oauth2/default",
8 "workspace_ids": ["ws-acme-prod"]
9 }'