Sign-in and access

Photon lets eligible staff inspect event and delivery metadata in an assigned workspace. The following guide describes the product session integration for installations where an administrator has enabled it.

Signing in and reading an event

1. Choose your company sign-in target. A target identifies the Keycloak realm (the identity domain) and the sign-in rules for that installation. Keycloak can redirect you to your company identity provider and request MFA.
2. After sign-in, the backend for frontend (BFF) exchanges the authorization code and gives the browser a protected session cookie. The browser receives an opaque context for the tab. Provider tokens stay on the server.
3. When you open an event, the backend checks your current workforce eligibility, workspace and permission for the requested operation. Event discovery and delivery metadata have separate permissions. Reading payloads, replaying events and changing settings require additional grants.

Normal page reads reuse the product session. Starting an explicit company login requests fresh authentication. If Google handles sign-in, the login waits for Google’s response. Listing events uses the workforce information already collected by the service.

How membership stays current

In the Google Directory integration, a credential renewer obtains short-lived read access. A separate worker checks the configured group and each member’s account status, then stores a verified observation in PostgreSQL. Stable provider and realm identity IDs link each person to their account even if their email changes.

With default settings the worker starts a refresh about every 150 seconds. The source is held during collection. Protected requests can be denied during that hold or when the last verified observation reaches five minutes of age. An incomplete scan cannot renew eligibility. These defaults suit a bounded staff group. The default reader caps a scan at 1,000 members and 30 seconds.

When someone loses access

Once a completed sync detects loss of eligibility, the worker records the denial and queues session cleanup. A separate loop checks the cleanup queue about once per second and retries failed work. Protected requests can be denied before cleanup completes. For Photon-only offboarding, cleanup targets the person’s Photon sessions. Removing a person from one app and suspending their entire company account have different effects.

Who approves changes?

Control is the administrative interface for changes to trusted installations and realms. An authorized person requests a change, an independent reviewer confirms it with fresh authentication, and a one-time executor verifies the approval before recording the change. Opening Photon or viewing delivery metadata uses the ordinary product session.