Cerberus

The front door

Cerberus is the identity service for the whole platform. Every application behind it, and every person using one, arrives through the same door. Applications never see a password and never store one; they ask Cerberus who the visitor is and what that visitor is allowed to do, and they act on the answer.

What it gives you

One account per person, for everything. Somebody joins, gets an account, and that account works everywhere. Somebody leaves, the account is disabled once, and the whole platform closes behind them at the same moment. There is no list of forgotten logins on forgotten systems.

Permissions, not guesswork. Access is described as named roles, built from fine grained permissions that each application declares for itself. A role is assembled once and handed to as many people as needed, and an individual can be granted or denied something extra without inventing a new role for one person. The console shows exactly what an account ends up with.

Applications as first class citizens. Every application that uses the platform is registered, so an administrator can see what is connected, what each one is entitled to ask for, and revoke it in one move. Machine to machine access works the same way, with its own credentials, never a person's.

A sign in that expects to be attacked. The login path is deliberately narrow: a picture challenge, throttling, optional second factor, and a record of every refusal. Passwords are stored with a modern memory hard hashing scheme, so a stolen database is not a stolen password list.

A record of who did what. Sign ins, refusals and token events are written to a log an auditor can read and export.

Who it is for

Any system with more than one application and more than one person. It is the piece that stops "who still has access to this?" from being an unanswerable question.