Documentation / Security & Access
Identity, login, basic roles and MFA
Authenticate with browser OAuth PKCE or CI tokens, store sessions in the OS keyring, enforce tenant-scoped basic roles, and review MFA readiness.
1. Browser Valkey sessions, PKCE login and machine tokens
Installations on >=1.10.0 expose ControllerEndpointUrl via IngressMode=public-edge or private-enterprise: browser console logins use a 256-bit __Host-rippflow_session (HttpOnly; Secure; SameSite=Lax) cookie and X-Rippflow-Csrf with zero tokens in localStorage. Serverless Valkey 9 stores only HMAC-keyed session validity (rippflow:ctrl:sess:<HMAC-SHA256> → {"v":1,"active":true} + TTL) with zero PII, credentials, or claims, while DynamoDB remains authoritative for session bindings, identity, and permissions on every request. CLI callers authenticate via OAuth PKCE (>=1.8.2, stored in macOS Keychain, Windows Credential Manager, or Linux Secret Service) or asymmetric private_key_jwt exchange (rippflow auth machine-token, sent via X-Rippflow-Machine-Token + x-amz-content-sha256; legacy 1.0.x–1.9.x JwtApiUrl/MachineApiUrl compatibility is preserved).
For interactive sign-in, legacy bearer tokens or CI credentials, follow Connect an installation. Run rippflow auth status --json to inspect the current session.
2. Tenant isolation, basic roles and user management
The Controller binds every authenticated request to its tenant. Initial deployment creates one bootstrap admin whose temporary password is stored only in your AWS Secrets Manager.
rippflow users list --json
rippflow users create --username operator --email operator@example.com --role readOnly --json| Basic Role / Mechanism | Granted Scopes & Authority | Status & Boundary |
|---|---|---|
viewer (readOnly) | workflow:read, permitted workflow:logs:read | Implemented (>=1.0.0); tenant-isolated |
operator | Read scopes plus approved operational actions (e.g., operations, cell checks) | Implemented; subject to installation capability gates |
deployer (readWrite) | Adds deployment:write for reviewed manifest publication/activation when owner routes are enabled | Never approves unverified handlers or grants AWS_IAM deploy rights |
admin | Adds users:manage (GET/POST /v1/users) | Implemented (>=1.8.0); cannot edit principal policy templates or handler approvals |
3. Mandatory MFA and certification status
Baseline policy requires TOTP authenticator apps or user-verified WebAuthn passkeys (MULTI_FACTOR_WITH_USER_VERIFICATION) for every human role, plus customer-account Secrets Manager recovery-code escrow for admins.
Current status: Mandatory MFA and admin recovery-code escrow are defined contracts, not yet enabled on the default Cognito Lite TEST password pool. Do not enable pool-level MFA enforcement before deploying the MFA challenge UI and recovery verifier.
Verified sources
Checked 2026-11-05.
- Browser OAuth PKCE login 3a3be99 · main
- Basic roles and delegated user management 3a3be99 · main
- Mandatory MFA and recovery escrow 3a3be99 · main
- Identity, profiles and user routes 7f5ea32 · main