Authentication

Authentication is verifying who you are. Your identity provider handles this. AuthBoundry receives the authenticated identity and uses it to evaluate authorization.

Identity Providers

AuthBoundry works with any OAuth 2.0 compatible identity provider:

  • GitHub
  • Google
  • Okta
  • Azure AD
  • Auth0
  • Any OIDC provider

Sessions

When a user authenticates:

  1. Identity provider verifies credentials
  2. Identity provider returns authenticated identity + claims
  3. AuthBoundry creates a session for this identity
  4. Session is time-bound (default: 24 hours)
  5. Session can be revoked before expiration

Sessions are stored securely:

  • HttpOnly cookie (not accessible from JavaScript)
  • Secure flag (HTTPS only)
  • SameSite=Lax (CSRF protection)

Claims from Identity

When you authenticate, your identity provider provides claims. Common claims include:

  • email: Your email address
  • name: Your display name
  • groups: Groups/organizations you belong to
  • roles: Roles assigned by your identity provider

AuthBoundry receives these claims and stores them with your principal. Claims inform policy decisions but do not determine authority on their own.

Multi-Provider Accounts

One person can authenticate through multiple identity providers:

  • Authenticate via GitHub
  • Later authenticate via Google
  • Both map to the same principal (if linked)

This is handled at the principal level, not the authentication level.

Session Lifecycle

Create

User authenticates → Session created → Cookie set

Validate

On every request, AuthBoundry validates:

  • Session exists
  • Session is not expired
  • Session has not been revoked

Revoke

Sessions can be revoked:

  • User logs out
  • Administrator revokes session
  • User's identity is revoked

Expire

Sessions automatically expire after the session lifetime (default: 24 hours).

Important: Authentication ≠ Authorization

Authentication: Who you are (handled by identity provider)

Authorization: What you're allowed to do (handled by AuthBoundry policies)

Someone can be authenticated but not authorized to perform an action.

Next Steps