The Grassfish platform supports multiple identity scenarios, a user-based permission system, and session protection.
Identity scenarios
The following identity scenarios are available:
Single sign-on (SSO): We support SSO via OIDC and SAML. Modern setups primarily use OIDC while SAML remains available for legacy environments.
Identity provider (IdP): Typical IdPs are Entra ID (Azure AD) or Okta, but other IdPs can be integrated via the same protocols.
User roles and permissions
The platform supports fine-grained access management through roles and permissions.
Role inheritance from IdP: User roles or groups provided by the IdP can be automatically mapped to permissions in the Grassfish CMS.
CMS-managed roles: Roles can also be defined and managed directly within the CMS, either as an alternative to or in combination with IdP integration.
Granular permission model: Permissions are highly granular, ensuring users receive only the access rights required for their specific tasks.
Session protection
We provide multiple mechanisms to protect user sessions:
IP-bound sessions: Sessions can be tied to the client’s IP address to make session hijacking more difficult.
Sliding session timeout: A configurable sliding timeout automatically refreshes the session while the user remains active.
Multi-factor authentication (MFA): MFA is supported through the connected identity provider (Entra, Okta).