Entitle

Five applications, five logins, five permission models. That is how most platforms grow, and it is how ours did. Entitle is Booolean's centralised authentication and entitlement service: applications register once, users and groups are managed once, and every application asks the same question the same way. What is this person allowed to do here?

OneLogin and permission model for every app

ScopesAccess scopes, groups and actions per application

SDKClient library for consuming applications

AuditedSign-in and permission changes recorded

The problem it solves

Every new application in a family of systems tends to arrive with its own user table, its own idea of roles and its own login screen. Staff end up with several accounts, administrators repeat the same access changes in several places, and nobody can answer "what can this person do across all of our systems?" without a spreadsheet.

Entitle moves authentication and entitlement into one service that every registered application relies on.

What it does

Registered applications. Each application is registered with its own key and instance, so the service knows which application is asking and for which environment.
Central sign-in. Users sign in through Entitle and receive a session token that the application uses from then on.
Groups, access scopes and actions. Permissions are modelled as scopes and actions, assigned through groups, and answered per application, so an application asks what the signed-in user may do rather than keeping its own copy of the rules.
Customers, subscriptions and instances. Access can be tied to the organisation and subscription the user belongs to, which suits multi-tenant platforms.
Administration. An administration interface for applications, users, groups and the permission catalogue.
Audit. Sign-ins, denials and permission changes are recorded.
Client SDK. A client library, Booolean.Entitle.Client, so a consuming application integrates with a few calls rather than a custom implementation.

How an application uses it

Application  --(app key, instance, credentials)-->  Entitle
Entitle      --(session token, reason code)------>  Application
Application  --(token: who am I? what may I do?)->  Entitle
Entitle      --(user, groups, scopes, actions)---->  Application

Where it stands

Entitle is in development on Booolean's own platforms first, which is where every one of our tools started. We are hardening it against our own security review before offering it more widely. If your organisation runs a family of applications that each manage their own users, we would like to talk about whether Entitle fits. Get in touch.