SSO Security, API Keys & Audit Logs

Large enterprise deployments require seamless identity synchronization with corporate Identity Providers (IdP) and comprehensive audit logging to satisfy external security standards.

EasyEA’s Admin Hub incorporates federated authentication, scoped API keys for automated pipelines, and immutable audit ledgers.

1. Enterprise Single Sign-On (OIDC & SAML 2.0)

EasyEA natively connects to any open-standards corporate Identity Provider:

Microsoft Entra ID (Azure AD)
Okta Identity Cloud
Keycloak & Red Hat SSO
Google Workspace & Ping Identity

Core Configuration Parameters

Configurable within Admin Hub ➔ Authentication Settings (auth_config.py):

ISSUER_URL: The Identity Provider discovery endpoint (e.g., https://login.microsoftonline.com/{tenant-id}/v2.0).
CLIENT_ID & CLIENT_SECRET: Application registration credentials issued by your IdP.
ROLE_ATTRIBUTE_MAPPING: Automated synchronization mapping IdP groups to EasyEA roles (e.g., Active Directory group SG-Enterprise-Architects maps automatically to the Enterprise Architect role).

2. Scoped Enterprise API Keys for CI/CD

To enable headless CI/CD runners, GitHub Actions, GitLab CI, or custom Python scripts to interact with the platform, administrators issue scoped API Keys:

# Example API invocation using Bearer authentication
curl -X GET https://easyea.corp.lan/api/v1/elements \
  -H "Authorization: Bearer ea_live_7f8a9b2c3d4e5f6a..." \
  -H "X-Workspace-ID: corporate-core"

Granular Scoping: Constrain keys to specific workspaces and permissions (e.g., read-only, SaC validation only, or write access).
Expiration & Revocation: Enforce expiry intervals and instantly revoke compromised keys in one click.
Secure Secret Masking: The cleartext token is visible only upon creation and stored hashed in PostgreSQL.

3. Governance Audit Logs

Every critical action creates an immutable log entry in the audit repository (audit.py):

graph LR
    User[User / API Key] --> Action[Operation on Graph or Settings]
    Action --> Log["Immutable Audit Record"]
    Log --> Fields["Timestamp UTC | User ID | IP Address | Workspace | Entity Type | Action Type | Diff JSON"]

Audited Lifecycle Events

Asset Operations: Element creation, APM metric updates, lifecycle transitions, or deletions.
Schema Lifecycle: Diagram check-out (locking), check-in revisions, and historical rollbacks.
ADR Governance: Record creation, status changes (Proposed to Accepted), and deprecations.
Security & Access: User provisioning, role reassignments, password resets, and failed authentication attempts.

Audit streams can be exported to CSV/JSON or streamed into corporate SIEM platforms (Splunk, Elastic, Microsoft Sentinel).