Skip to main content

Enterprise Access

Enterprise access depends on more than a username and password. Organizations need to know who the user is, how they authenticated, which role or affiliation is current, which device and context are acceptable, and whether the requested action is permitted.

UbID can combine workforce credentials, adaptive authentication, device trust, federation, and verification policy while keeping authorization under institutional control.

The problem​

Traditional workforce identity often creates:

  • duplicated employee profiles across applications;
  • delayed onboarding and offboarding;
  • persistent privileges after role changes;
  • dependence on passwords and recovery desks;
  • manual verification of contractors and external professionals;
  • weak separation between identity, authentication, role, and authorization;
  • fragmented evidence for auditors and incident responders.

Portable role credentials can complement an enterprise identity provider without replacing it.

Participants​

  • Employer or sponsoring organization — issues employment, affiliation, or role evidence.
  • Employee, contractor, partner, or administrator — holds the credential and authenticates.
  • Relying application — requests evidence and applies access policy.
  • Enterprise identity and access authority — manages sessions, authorization, provisioning, and governance.

Credential examples​

An enterprise profile may represent:

  • current employment or contractor status;
  • department, role, or organizational affiliation;
  • authorization to represent an organization;
  • completion of required training;
  • certification for a privileged function;
  • device registration or approved-device state;
  • temporary assignment or project membership.

The credential should not become a universal employee record. Only claims needed for the relying service should be disclosed.

Example access flow​

  1. The organization establishes the person's employment or partner relationship.
  2. An authorized issuer provides a current role or affiliation credential.
  3. The user authenticates with an approved method.
  4. The relying service requests the credential and context required by policy.
  5. The holder authorizes presentation where appropriate.
  6. The verifier checks the credential, status, holder relationship, session, and requested context.
  7. The enterprise authorization service grants, limits, or denies the requested action.
  8. The decision and material evidence are recorded according to policy.

Authentication is not authorization​

UbID Access can establish a high-confidence session, but the application or authorization service still decides whether the user may:

  • view a resource;
  • approve a transaction;
  • administer infrastructure;
  • access personal or regulated data;
  • act on behalf of another organization;
  • perform a privileged or high-impact operation.

A valid employee credential may be necessary and still not be sufficient.

Onboarding, change, and offboarding​

Workforce trust must follow the employment lifecycle:

  • onboarding creates approved identity, authenticators, devices, and role evidence;
  • role changes issue or replace relevant credentials and update access policy;
  • temporary assignments expire or are withdrawn;
  • offboarding revokes or suspends credentials, sessions, devices, and entitlements;
  • reactivation requires a new authorized decision rather than reuse of stale evidence.

Federation and external partners​

OIDC or an enterprise identity provider can manage centralized authentication and sessions. Verifiable credentials can add portable evidence from employers, professional bodies, training providers, or partner organizations.

Federation and credentials are complementary: federation establishes a session with an identity provider, while credentials carry independently verifiable claims under policy.

UbID product composition​

  • UbID Access provides adaptive authentication and session policy.
  • UbID Credential Cloud issues workforce and role credentials.
  • UbID Wallet supports holder custody and presentation.
  • UbID Connect supports federation and trusted exchange.
  • UbID KeyVault protects institutional cryptographic operations.
  • UbID Pulse supports access evidence and operational posture.

Public documentation boundary​

Public documentation excludes customer role models, privileged-access rules, fallback procedures, session configuration, device identifiers, network topology, incident data, and administrative endpoints.

See also UbID Access, Authentication and Device Security, and WebAuthn, OpenID Connect, and OAuth.