Browser identity boundary

Private native-backend qualification, reviewed 21 September 2026. Not a stable public identity SDK or general enterprise SSO release.

Workspace starts a same-origin POST /auth/start. The gateway uses OIDC authorization code + PKCE, then validates signature, issuer, audience, nonce and expiry at its fixed callback. A server-cached transaction and signed browser cookie bind state to the browser; a replay or unbound callback is refused. Provider credentials and tokens are not exposed to Workspace JavaScript. An authorization code briefly passes through the callback; native credentials never appear in the URL.

An explicit (issuer, subject) mapping selects an existing native account. Email, username, groups and domains alone do not create accounts or grant data. Explicit invitation acceptance can create a new account after proof plus a matching verified provider email; it never auto-links an existing account by email. The gateway creates a short-lived native credential for that account and keeps it behind an opaque HttpOnly application session. Native project authorization remains authoritative. OSDU identity delegation is a separate gate; this does not exchange OIDC identity for arbitrary OSDU access.

The session lasts at most 10 minutes and never beyond ID-token expiry (five minutes in the qualified realm). There is no silent refresh. Local sign-out revokes the native browser credential. Application sessions are encrypted in PostgreSQL and survive a gateway restart; the separate pending OIDC transaction cache does not. The deployment secret must remain private and be backed up separately. Key rotation invalidates old sessions. With introspection enabled, provider activity is checked with a bounded 15-second cache; errors fail closed with retryable unavailability. Native account/mapping/credential revocation is independently checked per request. This is request-time verification, not push back-channel logout.

OIDC configuration is deployment-managed, not entered by arbitrary organization members. HTTPS is required except for explicitly configured loopback qualification. The running gateway remains private behind SSH, with one process. Production TLS, trusted-certificate hosting, multi-worker routing, SCIM, SSO-only enforcement and back-channel logout have not been qualified. Keep customer/source/sink credentials at their own execution boundaries.

Pilot endpoints

Same-origin JSON POSTs require the current CSRF proof:

Endpoint	Contract
/api/workspace/invite-create	Owner supplies organization_id, email; receives a one-time private URL.
/api/workspace/invite-list	Owner lists recent invitations for organization_id; never retrieves stored proof.
/api/workspace/invite-revoke	Owner supplies organization_id, invitation id.
/api/account/sessions	Lists only the caller’s active browser sessions.
/api/account/revoke	Caller supplies own session id or all; device credentials remain separate.

Invitation hashes expire in 48 hours. Acceptance is serialized and single-use. Proof travels in the invitation URL fragment, then in the browser-bound OIDC flow; it is not placed in request query strings. Organization grants and scientific project grants remain distinct. Admission/revocation events are control metadata, not lineage.

Configured HTTPS origins produce Secure/HttpOnly cookies and enforce exact Host and Origin. Trusted HTTPS OIDC passed in Mac Chrome with a diagnostic DNS mapping; virtual passkey enrollment and fresh passwordless assertion passed in Linux Chrome. Provider recovery through real Proton-to-Gmail delivery is qualified, including new-password login and old-password rejection. Physical passkeys and additional customer identity providers remain gates. Mac Chrome normal DNS/TLS passed. Invitation email delivery is a separate feature. Scientific schemas, units, nulls, CRS and exact asset revisions are unaffected by these account features.