Enterprise

Each capability below links to the guide that documents it.

Audit log

Every sign-in, consent, administrative change, token revocation, and key rotation is an event that names the action, both accounts involved, the client, the device, the IP address, and the user agent. Manage filters events by account, action, and client, and marks the ones that call for attention, such as a refused sign-in or a replayed refresh token.

Audit export and retention

A tenant keeps events for 30 days to seven years, and any manager downloads a range as a file. See keeping and exporting activity.

Event streaming

An event stream posts each event, signed, to an HTTPS endpoint as it happens, and retries failed deliveries. See event streams.

Shared signals

masks is an OpenID Shared Signals transmitter. A receiver registers a stream, and masks pushes it signed CAEP and RISC events about the people who use that receiver. See shared signals. masks also receives them: a provider that revokes a session or disables an account signs that person out here. See receiving signals from a provider.

Single sign-on and provisioning

masks signs people in through OpenID Connect, OAuth 2.0, and SAML 2.0 providers, acts as a SAML identity provider for applications, and keeps accounts in step with a directory over SCIM. See SSO and SAML.

Home-realm discovery

masks sends someone who types an email address to their company’s provider, once the tenant proves it controls the domain with a DNS record. See sending a domain to its provider.

Custom domains

A tenant serves sign-in from its own host, such as login.example.com, as a second issuer beside the usual address. See custom domains. Sending mail from the tenant’s domain is planned.

Organizations and roles

An organization holds members in roles, and an app that asks for the organization scope gets the organization and role in an org claim. Each organization can have its own sign-in policy, provider, SCIM directory, and event stream. See organizations.

Manage roles

masks:manage:read, masks:manage:support, and masks:manage:security let an auditor, a support team, and a security team each do their job in /manage and nothing more. See manage roles.

Session policies

A sign-in policy sets a session lifetime and an idle timeout. A session past either ends, and its refresh tokens stop working. See how long a session lasts.

Passwordless email

A sign-in policy can offer a six-digit code sent to the person’s address as a first factor, with or without a password. See signing in with an emailed code.

Adaptive risk

masks scores each sign-in from its device, network, recent failures, and whether the password appears in a known breach. A sign-in policy asks for a second factor or refuses from a score it names. See risky sign-ins.

Step-up authentication

Some actions need a stronger or fresher sign-in than the session holds, such as moving money.

• ID tokens carry auth_time, amr, and an acr of urn:masks:acr:pwd or urn:masks:acr:mfa, the level the sign-in reached.
• A client asks for a fresh sign-in with max_age or prompt=login.
• A client asks for a second factor with acr_values=urn:masks:acr:mfa or an essential acr in the claims parameter. A session that already used a second factor is not asked again. Otherwise masks asks for a factor the account holds, or asks the account to add one.
• acr_values is a list of acceptable values, so a request that also accepts urn:masks:acr:pwd is satisfied by a password.
• In a sign-in policy, Required for everyone makes every account hold a second factor. Asked again at an app sign-in when the session did not use one asks for it before the app receives a code, even when the session started with a password alone.

Token exchange

A service acting for a person, including an AI agent, trades the token it holds for a narrower one for a downstream service (RFC 8693). Each exchange is recorded as an event without the token. See exchanging a token. A rich authorization request says what a token may do, such as one payment to one payee, and an exchange passes those details on or narrows them.

Migration

Migration is planned. It moves accounts off another provider without asking anyone to reset a password.

• An import reads a file of accounts in batches of 500: Auth0’s bulk export (bcrypt hashes), Firebase’s auth:export (modified scrypt with the project’s hash parameters), or a generic JSON file with algorithm, hash, and salt. Each batch is recorded as an account.imported event.
• masks keeps each imported hash in its original format and replaces it with its own the first time the person signs in.
• Okta and Cognito do not export password hashes. For those, masks checks a password against the old provider the first time the person signs in, stores its own hash, and does not ask the old provider again. Manage shows how many accounts still depend on it.
• An imported email is marked verified only when the export says so.