Every sign-in a B2B buyer will ask for. Working.
Passkeys, MFA, OIDC, SAML with a built-in IdP, SCIM, policies, sessions — audited.
Sign in to the demo workspace as
- signature verified ✓
- binding
- HTTP-POST
- inResponseTo
- _b7a2c41e
<samlp:Response ID="_3f9c05d1" InResponseTo="_b7a2c41e" Destination="https://auth.example/api/saml/acs"><saml:Issuer>https://idp.penrose.example/metadata</saml:Issuer><ds:Signature><ds:SignedInfo><ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/><ds:Reference URI="#_3f9c05d1"><ds:DigestValue>Qm9ndXMgZGlnZXN0IHZhbHVl…</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>c2lnbmF0dXJlIGJ5dGVzLCBzaG9ydGVuZWQ…</ds:SignatureValue></ds:Signature><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status><saml:Assertion ID="_91e0aa7c"><saml:Subject><saml:NameID>maya.okafor@penrose.example</saml:NameID></saml:Subject><saml:AttributeStatement><saml:Attribute Name="groups"><saml:AttributeValue>penrose-staff</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></samlp:Response>
What is in it
SAML 2.0
A service provider and a built-in identity provider in one codebase. Every message of the round trip is recorded and drawn.
Passkeys
Register one, sign out, sign back in with it. The session remembers that it proved a second factor.
Authenticator codes
TOTP with a QR code, ten one-time recovery codes, and a second step at sign-in.
Policies
A role matrix, attribute rules in a small expression language that never runs code, and a tester that shows which rule decided.
Sessions
Every browser signed in to your account, how each one got in, and a way to end any of them.
Audit trail
Sign-ins, refusals and security changes in a table the database itself refuses to edit.
SCIM provisioning lives in the console under Single sign-on. Google and Microsoft sign-in are wired up but switched off here, because they need OAuth credentials this demo doesn't hold.