Auth & Security

Authentication

Review authentication options, credential handling, and access verification for your Zof deployment.

Overview

Authentication establishes the identity making a request. Confirm the sign-in, SSO, session, and automation-credential methods supported by your Zof service before configuring an identity provider or building a login flow.

Authentication and authorization are separate. A valid session does not mean an identity may access every organization, application, environment, or administrative action.

Prerequisites

  • An identity administrator and a pilot group authorized for testing.
  • The current supported identity configuration and a tested administrator recovery process.

Step-by-step procedure

Map the identity boundary

Document allowed users, the source of identity, required authentication factors, and how users are assigned to the service. Distinguish interactive access from automation.

Test sign-in and failure behavior

Use approved test identities to check allowed users, unassigned users, expired credentials, and revoked access. Preserve safe diagnostics and avoid logging tokens or one-time codes.

Validate session lifecycle

Confirm sign-out, expiry, and how existing sessions are handled when access is removed. Test the recovery path before applying a restrictive organization-wide policy.

Key concepts

Identity provider
The system that authenticates a person or workload and supplies identity information to a relying service.
Session
A period of authenticated interaction governed by the service’s supported lifecycle and policy.

Best practices

  • Use supported configuration instructions for your deployment instead of assuming a protocol or UI control exists.
  • Separate administrator access from routine work where practical.
  • Assign owners and revocation procedures to automation credentials.

Was this page helpful?