---
title: "Identity and single sign-on"
slug: "identity-sso"
updated: 2025-12-05T08:00:22Z
published: 2025-12-10T14:08:19Z
canonical: "docs.grassfish.com/identity-sso"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.grassfish.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Identity and single sign-on

The Grassfish platform supports multiple identity scenarios, a user-based permission system, and session protection.

****Identity scenarios****

The following identity scenarios are available:

- **Single sign-on (SSO)**: We support SSO via OIDC and SAML. Modern setups primarily use OIDC while SAML remains available for legacy environments.
- **Identity provider (IdP)**: Typical IdPs are Entra ID (Azure AD) or Okta, but other IdPs can be integrated via the same protocols.

****User roles and permissions****

The platform supports fine-grained access management through roles and permissions.

- **Role inheritance from IdP**: User roles or groups provided by the IdP can be automatically mapped to permissions in the Grassfish CMS.
- **CMS-managed roles**: Roles can also be defined and managed directly within the CMS, either as an alternative to or in combination with IdP integration.
- **Granular permission model**: Permissions are highly granular, ensuring users receive only the access rights required for their specific tasks.

****Session protection****

We provide multiple mechanisms to protect user sessions:

- **IP-bound sessions**: Sessions can be tied to the client’s IP address to make session hijacking more difficult.
- **Sliding session timeout**: A configurable sliding timeout automatically refreshes the session while the user remains active.
- **Multi-factor authentication (MFA)**: MFA is supported through the connected identity provider (Entra, Okta).