Identity, Authentication, and Authorization

Access to ObserveID is based on the identity model. Users who access ObserveID are represented by identities and must have a supported authentication method and the appropriate authorization to access application resources and capabilities.

Identity

An identity is a normalized and consolidated representation of an authoritative source record for a real-world individual or, where supported, a non-human entity whose lifecycle and access are governed across connected systems.

An identity can be associated with multiple accounts, access assignments, activities, and attributes across connected systems.

The primary source of truth for a defined identity population is an authoritative source trusted by the organization. ObserveID creates and maintains identities based on authoritative source data aggregated through integrations with systems such as Oracle HCM, ADP, Active Directory, Workday, or another approved personnel or identity data source.

Identity creation is part of the Joiner-Mover-Leaver (JML) lifecycle process and is initiated based on authoritative source data and configured lifecycle rules. When a new authoritative source record is identified and meets the applicable identity creation criteria, ObserveID creates the corresponding identity. The subsequent onboarding process can provision access to connected target systems based on applicable birthright roles and other configured access policies.

If a connected system is configured for single sign-on (SSO) in ObserveID and the identity has an applicable account, the user can authenticate to ObserveID through that provider. Common identity providers used for SSO include Microsoft Entra ID, Okta, and Google.

Where local authentication is required, ObserveID can establish the corresponding application account and local authentication credentials in accordance with configured policies and lifecycle rules.

Local User

A local user is an ObserveID application account associated with an identity. It provides the application-level security context through which authentication and authorization are applied when the user accesses ObserveID. The existence of a local user account does not necessarily mean that local authentication credentials are used; a user may authenticate through an external SSO provider while authorization within ObserveID is governed through the associated local user account.

Based on the configured lifecycle policy, a local user can be automatically created for an identity when the identity has an Active status, meets the applicable local user creation criteria, and does not already have a local user account. During offboarding, the identity transitions to the applicable terminated or inactive state, and the associated local user account is disabled, removed, or otherwise handled in accordance with the configured lifecycle policy.

Like other application accounts, a local user account can have authentication credentials and assigned roles. Where local credentials are used, they support authentication. Assigned roles determine the user's authorized access within ObserveID.

Authentication of Identities

ObserveID supports the following authentication methods for identities that have access to the application:

SSO authentication – The user authenticates through an external identity provider configured for SSO in ObserveID. The external provider performs authentication and returns the authentication information required by ObserveID to establish the user session. When multi-factor authentication (MFA) is required, MFA is performed and enforced by the external identity provider according to its authentication policies.
Local authentication – The user authenticates directly to ObserveID using credentials associated with the local user account. ObserveID validates the credentials. When MFA is configured for local authentication, ObserveID requires the user to complete the applicable additional verification step before authentication is completed.

Regardless of the authentication method, the authenticated user is associated with the corresponding ObserveID identity and local user account.

Authorization of Identities

Authentication determines who the user is. Authorization determines what the authenticated user is allowed to access and perform in ObserveID.

Authorization is independent of whether the user authenticates through SSO or with local credentials. After successful authentication, ObserveID evaluates the roles assigned to the user's associated application account. These roles define the permissions available to the user and determine which ObserveID resources, information, and operations the user is authorized to access.

An identity can exist in ObserveID without ever using local credentials to sign in. For example, a user can authenticate exclusively through an external SSO provider. The user's authorization within ObserveID remains governed by the roles assigned to the associated application account. This separation allows authentication to be delegated to an external identity provider while authorization remains centrally controlled by ObserveID.

Security Model

ObserveID separates identity, authentication, and authorization so that authentication can be delegated to an organization's approved identity provider while access to ObserveID resources and capabilities remains governed by centrally managed authorization policies and roles. This model enables organizations to integrate ObserveID with their existing authentication controls while maintaining consistent application-level authorization.