One place to decide who may do what
CKN Identity is the platform's central sign-in and access service, built on OAuth2 and OpenID Connect and covering tenants, roles, permissions and tokens. People sign in once, and every other service checks tokens on its own without calling back each time.
The whole organisation on one page
People, services, applications, roles and permissions of a tenant, summarised on one dashboard.
Every sign-in can be traced
See who signed in, by which method, and why an attempt succeeded or was refused.
What CKN Identity does
Sign-in and OAuth2 / OIDC standards
A complete identity provider. People, apps and services connect through open standards, so nobody has to write a login system of their own.
- Authorization code flow with PKCE (S256) required for every client
- Device flow for screens without a keyboard
- Userinfo, introspection, revocation and end-session endpoints
- Standard discovery document and JWKS
Isolated tenants
Each tenant gets its own realm and issuer, so one customer's people and permissions never mix with another's. A dedicated tenant-isolation test suite backs this up.
- Issuer and signing keys per tenant
- Membership and invitations into a tenant
- Suspend and restore a tenant from the console
- Cross-tenant actions are recorded as security events
Roles, permissions and access policy
Decide who can do what, one operation at a time, with a console page that shows any person's effective access.
- Roles, permissions and role assignments
- Scope grants with configurable scope types
- Access policies with revise, submit, approve and activate steps
- Effective access explorer for administrators
Strong authentication
Passwords and passkeys (WebAuthn), with account lockout after repeated failures and step-up checks for sensitive actions.
- Register a passkey and use it as a second proof
- Account recovery by email
- Device registration and sign-in risk assessment
- Federation to external identity providers
Bound tokens and delegation
Limit the damage of a leaked token by binding it to the client it was issued to, and let services act on a person's behalf within agreed limits.
- Sender-constrained tokens with DPoP and mTLS
- Token exchange and delegation grants with expiry
- Cascading revocation of sessions and refresh tokens
- Service identities with per-audience grants
Audit and incident response
Every privileged action is recorded, and the console has incident tools built in, so nobody has to edit a database by hand.
- Audit timeline and security events
- Break-glass access: request, approve, activate, revoke
- End a person's sessions or mark a signing key compromised
- Outbox events delivered through Integration to other systems
Built and tested at this scale
These figures are counted from the service's code and test suite. They are not speed benchmarks.
Figures come from CKN's own test suites and benchmarks. Real results depend on each system's hardware and data volume.
What your business gets
Lower cost: build login once
Every app and service shares one sign-in and one permission model. Teams stop writing and maintaining a login per project, and users keep a single credential.
Faster paths: services verify tokens themselves
Other services check a token's signature against published keys, so they do not call Identity on every request. That means fewer dependencies and fewer places to slow down.
Control risk and keep an audit trail
Operation-level permissions, bound tokens, approved break-glass access and a full audit trail let you answer who did what and when, and cut access immediately when something goes wrong.
Example: get a token, then search principals
Who relies on it
- Integration, which issues delegation and drains outbox events
- Portal and Intelligent, for user sign-in and permissions
- Engine and Console, for operator sign-in
- Every business service, which validates tokens locally
POST /oauth/token HTTP/1.1
Host: identity.example.com
Content-Type: application/x-www-form-urlencoded
grant_type=client_credentials&client_id=ckn.systems.example&client_secret=<CLIENT_SECRET>
GET /identity/principal/search HTTP/1.1
Host: identity.example.com
Authorization: Bearer <SERVICE_TOKEN>
X-CKN-Tenant-Id: <TENANT_ID>
X-CKN-Operation-Code: IDENTITY.IDENTITY.PRINCIPAL.SEARCH
HTTP/1.1 200 OK
{"success":true,"data":[ ... ],"page":{"has_more":false,"limit":50}}