Identity & access
SSO, SCIM provisioning, and passwordless unlock.
OIDC sign-in to your IdP, SCIM 2.0 to auto-provision users and groups, and WebAuthn-PRF passkeys that unlock your personal vault without typing a passphrase. IdP group claims map to your company roles and queue team memberships for approval. SSO and SCIM are part of the Enterprise plan.
IdP
Okta / Entra / Google
OIDC + SCIM
login + provisioning
Caldyr
teams · roles · passkey unlock
How it works
1
User clicks "Log in with SSO"
Standard OIDC discovery from work email domain.
2
OIDC redirect
Off to your IdP: Okta, Entra, Google, anything OIDC.
3
SCIM syncs & JIT-provisions
User optionally created on first sign-in (a per-company setting). Group claims map to your company roles; team memberships are queued for approval.
4
Passkey unlocks your personal vault
WebAuthn-PRF derives the wrap key. No passphrase typed. Your master key never leaves the device.
Deep dives
SCIM 2.0 provisioning
Off-boarding in your IdP propagates within seconds. No orphaned access. Standard /scim/v2/Users and /Groups endpoints.
Group → team/role mapping
IdP group claims map to your Caldyr company roles, configured per company and applied on every SSO sign-in. Team memberships are queued for approval rather than granted at once.
WebAuthn-PRF auto-unlock
The passkey produces a deterministic PRF output inside the authenticator. HKDF derives the wrap key for your personal vault, entirely in the browser. We receive neither the PRF output nor the derived key — only the wrapped blob.
SCIM mapping example
config · company_idp_configs.role_mapping (JSON)
# IdP group → company role and, optionally, a team (queued for approval)
{
"acme-platform-eng": { "company_role": "admin",
"team_id": "<platform-team-uuid>",
"team_role": "admin" },
"acme-backend-eng": { "company_role": "member",
"team_id": "<backend-team-uuid>",
"team_role": "member" },
"acme-contractors": { "company_role": "viewer" }
}
# Company roles: admin, member, viewer. Groups with no entry get the
# IdP config's default role (member or viewer).
Offboarding in your IdP = instant revoke here.
Disable a user in Okta on Friday afternoon: their access is gone before they close the laptop. No "did anyone remember to remove…" check on Monday.
Compare
| Caldyr | Manual user mgmt | SSO without SCIM | |
|---|---|---|---|
| JIT provisioning | on first login, if enabled | create by hand | login works · no profile |
| Auto-deprovision | SCIM push | manual | stale until manual |
| Group → role mapping | IdP group claims map to company roles; team access is queued for approval | assign by hand | default role only |
| Passwordless unlock | WebAuthn-PRF | password only | password fallback |
| Personal vault after SSO | zero-knowledge personal vault | N/A | no client-side vault |
FAQ
Any standards-compliant OIDC IdP, with SCIM 2.0 for provisioning. We test against Keycloak; tell us which IdP you use and we will verify it with you.
No, OIDC alone works, with optional just-in-time provisioning on first sign-in (a per-company setting). But without SCIM you lose auto-deprovision and group sync. Most enterprise customers turn SCIM on.
Built-in TOTP with recovery codes and passkey (WebAuthn) sign-in are supported for password accounts. With SSO, your IdP's own sign-in policies, including any MFA, apply.
WebAuthn-PRF returns a deterministic secret derived inside the authenticator. We use HKDF to expand it into your vault's wrap key, entirely client-side. We see only the encrypted vault blob.
Ready to govern your AI infrastructure?
Request access in minutes, or talk to us about your air-gap deployment.