Zero-Trust Authentication & SSO

Cryptographically signed JWT token claims and 120-second single-use ticket handshake protocol

CONNEX Cloud OS maintains a strict zero internal password storage policy, delegating core credential validation entirely to Firebase Authentication and Google Identity.

1. 120-Second Single-Use Ticket Handshake

   Cross-domain SSO handshakes utilize cryptographically secure UUIDv4 tickets mapped in Redis with a 120-second TTL. Tickets are burned immediately upon first exchange (/api/v1/auth/exchange), preventing replay attacks.

2. Mathematical Token-Level Authorization

   User roles (role), jurisdictional tenancy (home_country), and admin privileges are signed directly into JWT ID token Custom Claims. Downstream microservices perform sub-1ms authorization checks without hitting central databases.

3. 7 Standard Enterprise RBAC Roles

   Access is rigorously governed across 7 explicit roles: super_admin, founders, devops, bizops, demo_cx, customer_b2b, and customer_b2c.