Identity & access
Penfield supports enterprise identity integration and local accounts. Access inside the product is governed by role-based access control (RBAC).
Authentication options
| Mode | Who manages identity | Typical use |
|---|---|---|
| SSO | Your identity provider (IdP) | Enterprise deployments with centralized identity |
| Local users | Penfield (accounts created in the product) | Deployments that use local authentication instead of enterprise SSO |
You choose the mode for the deployment. Configuration steps for operators are in Product Docs → Manage users and permissions and Enable SSO.
Single Sign-On (SSO)
Penfield integrates with enterprise IdPs using OpenID Connect (OIDC).
Documented IdP integrations:
- Microsoft Entra ID
- Active Directory Federation Services (AD FS) (OIDC / generic OIDC provider)
Other OIDC-compatible IdPs can be evaluated case by case.
SSO security properties
- Authentication (passwords, MFA, conditional access, group assignment) remains with your IdP.
- Penfield receives identity assertions over OIDC and maps the user into the application.
- User create/disable for application access is managed in the IdP; Penfield manages the user’s application role.
- First successful SSO sign-in provisions the user record in Penfield with a default application role, which an administrator can change.
When SSO is enabled, multifactor authentication is enforced by your identity provider policies (for example Entra ID Conditional Access), not by a separate Penfield login MFA flow.
Local users
When local authentication is used:
- Administrators can create and delete local user accounts as needed.
- Users set passwords through secure recovery / password-setup links.
- Local authentication supports multifactor authentication (MFA).
- Passwords are stored using Argon2id hashing.
Local accounts are suitable for initial setup, environments without IdP integration, or controlled emergency access, according to your policy.
Role-based access control (RBAC)
Penfield roles limit what users can see and change inside the product. Examples of role tiers include:
| Role | Intent |
|---|---|
| Super Admin | User and role management, system settings, integrations, full operational access |
| Admin | Broad visibility into views and reports; not user/system administration |
| Analyst | Day-to-day analyst work within assigned scope |
Only Super Admins manage users and role assignments. Safeguards prevent removal of the last Super Admin. See Manage users and permissions for current role behavior.
Audit logging
User-management activity is recorded in an audit log, including events such as:
- users created or deleted
- profile updates
- role changes
- recovery links issued
Events include actor, target, authentication method, and timestamp.
Access summary for security questionnaires
| Question | Answer |
|---|---|
| Does Penfield support SSO? | Yes |
| Which protocol does SSO use - SAML or OIDC? | OIDC |
| Does Penfield support local user accounts? | Yes - create and delete anytime when local mode is used |
| Does Penfield support MFA? | Yes - via IdP policies for SSO; MFA is available for local accounts |
| How is authorization handled inside the product? | Application RBAC (Super Admin / Admin / Analyst) |
| How are local passwords stored? | Argon2id hashes for local passwords (not used when SSO is enabled) |