SSO / IAM Platform

Ekzo Identity — a central authentication authority

Single Sign-On and access management built on OpenID Connect over OAuth 2.0. One login for the user, signed JWT tokens for every platform microservice.

OIDC 1.0over OAuth 2.0

RS256JWT signing

2verification modes

∞microservices

Purpose

The platform's central authentication authority

Identity issues signed JWT access tokens that downstream services verify in two ways: locally using the public key from the JWKS endpoint (no network round-trip), or via the token introspection endpoint server-side.

Applications register as OAuth 2.0 clients and obtain tokens via standard flows. Users authenticate once, and their identity plus role-based permissions are carried in every token across the platform.

SSO

Single login for all applications and services in the ecosystem

IAM

Management of identity, roles and access permissions

OAuth 2.0 Server

Authorization Code + PKCE and Client Credentials flows

OIDC Provider

ID tokens, UserInfo, Discovery and JWKS out of the box

Scenarios

One platform — three scenarios

Identity covers authentication for customers, workforce and services from a single authority

Seamless login for customers

Sign-up and sign-in via OAuth 2.0 / OpenID Connect

Self-service email-based password recovery

Standard scopes: openid, profile, email, phone, offline_access

Interaction model

One login — a token for every service

Apps obtain a JWT via standard flows; microservices verify it locally or via introspection

Applications & flows

Web App

Auth Code + PKCE

Mobile App

Auth Code + PKCE

Backend / M2M

Client Credentials

SPA

OIDC

Ekzo Identity

Authentication · Authorization · Token issuance

RS256 signingJWKS publishingToken introspection

Signed JWT access token

Platform microservices

Verify the token locally via the JWKS key or via the introspection endpoint and read permissions from claims

Supported standards

Open identity standards

Identity is built on industry standards — compatible with any OIDC/OAuth client

OAuth 2.0Authorization Server

Authorization Code + PKCE for browsers, Client Credentials for M2M, token revocation (RFC 7009) and resource indicators (RFC 8707)

OpenID Connect1.0

ID tokens, UserInfo, Discovery (.well-known) and identity provider

JWTRS256

Self-contained signed tokens with a KID header and key rotation

JWKSRFC 7517

Publishes the public key for local token verification with no round-trip

PKCERFC 7636

Protects against authorization code interception for public clients

IntrospectionRFC 7662

Server-side token validation and retrieval of active claims

Get started

Authentication in four steps

From app registration to token verification in a microservice

Create an OAuth 2.0 client: redirect URIs, scopes and secrets. Configure claim mapping for your service.

Client

The user signs in

Authenticate via login/password, LDAP or an external provider. One login — access to all services.

Identity issues a JWT

A signed RS256 access token with the user identity and claims computed by the application mapping.

Token

The service verifies it

Locally via the JWKS public key or via introspection — with no session storage.

Verify

Capabilities

Everything for identity management

A full set of authentication, authorization and access management tools

User authentication

OAuth 2.0 Authorization Server

Authorization Code + PKCE for browser apps and Client Credentials for machine-to-machine.

OpenID Connect provider

ID tokens, UserInfo endpoint, OIDC Discovery (.well-known) and a JWKS endpoint for signature verification.

JWT access tokens

Self-contained RS256 tokens. Downstream services verify locally via JWKS or via introspection.

Application management

Security & logging

RSA signing keys, enforced PKCE, CORS configuration and logging of issued tokens.

Users & roles

Users, roles and assignments — in the UI and through the REST API. The user's roles are carried in token claims.

Sessions, tokens & logout

List and force-revoke login sessions, revoke tokens, refresh tokens under the offline_access scope and RP-initiated logout.

Developer experience

Standard OIDC — no magic

Ready Discovery, JWKS and introspection endpoints. Verify tokens locally or server-side.

OIDC DiscoveryClient auto-configuration via .well-known/openid-configuration

Local JWKS verificationSignature verification with the public key — no network round-trip

OpenAPI 3.x specThe running service serves its API description at /api-docs

identity · endpoints

# OIDC discovery
GET  /.well-known/openid-configuration

# JWKS — public key for local JWT verification
GET  /oauth/discovery/keys

# Server-side token introspection (RFC 7662)
POST /oauth/introspect

# Token revocation (RFC 7009)
POST /oauth/revoke

# UserInfo
GET  /oauth/userinfo

Claim mapping

Flexible token structure per application

Each OAuth client defines a FEEL expression that builds the JWT claims at issuance — from the user's roles and attributes or static values

FEEL expressionEvaluates to a context whose entries are merged into the application's access token

user · applicationThe user with their roles and the OAuth client are in scope; M2M tokens have no user

aud, sub, …Mapped claims are applied last and can override base claims — the token audience, for example

claim_mapping · FEEL

{
  name: user.name,
  aud: ["tasklist-api", "operate-api"],
  permissions: {
    "tasklist-api": ["read:*", "write:*"],
    "operate-api": ["read:*"]
  }
}

Feature map

Everything for identity management

A full set of authentication, authorization and access management tools

Password login

Auth Code + PKCE

Client Credentials

Refresh tokens

Token introspection

OIDC Discovery + JWKS

ID tokens & UserInfo

RS256 + KID

Application claims in FEEL

Application management

Token revocation (RFC 7009)

RP-initiated logout

Audience restriction (RFC 8707)

LDAP / external providersplanned

Multi-factor (TOTP/SMS)planned

Field-level / row-level ACLplanned

Zero-downtime key rotationplanned

Who needs it

Unified identity for any architecture

Identity fits microservices, corporate portals and external APIs

Microservice platform

A single authentication authority for all services. Stateless token checks via JWKS with no shared sessions.

Corporate SSO

One login for all internal company apps. Roles and permissions centralized in the token.

API protection

Issue scoped tokens for partners and integrations. Server-side validation via introspection.

External integrations

Standard OIDC/OAuth lets you connect any compatible client and identity provider.

Connect Identity to your platform

We are happy to answer your questions or give a personal demo of Identity.

Operational documentation →