PRISM Identity

Single sign-on, federation & provisioning. Your directory decides who; PRISM decides what.

// CAPABILITIES

Single sign-on (SSO) through OpenID Connect federation — one login with the customer’s own directory: Keycloak brokers to the identity provider (Entra ID); MFA stays under the customer’s policy.
Group-to-organisation mapping — gate, feature and organisation groups from the directory resolve to PRISM roles and org placement at login.
Automated provisioning — first-login auto-provisioning and SCIM 2.0 push from Entra ID; leavers lose access at the next login.
Authorisation stays in PRISM — role matrix, cross-organisation ACLs and case-level access are governed inside the platform, audit-emitted per decision.

Cookie-only OIDC with pre-emptive refresh, role-protected endpoints, group claims mapped to PRISM authorities, protected-person handling at the data layer.

Request Access

// LIVE SYSTEM VIEW

PRISM_IDENTITY :: SESSION 0x08F

> IDP: ENTRA-ID (BROKERED)

> Protocol: OIDC · PKCE

> Groups → org: MAPPED 14/14

> Provisioning: SCIM 2.0

> Audit stream: LIVE