2finity Identity
One identity. Many relationships.
A person is a professional, an employee, a customer, a supplier, a partner, an administrator or the owner of an agent, often several at once. CORE keeps one identity and models everything else as relationships.
Authority
CORE’s identity layer
2finity Identity is the identity authority for CORE. It lives on 2finity.com, holds credentials and sessions, and links an identity to the organizations, roles and agents it is connected to. The Identity layer of CORE describes what it stores; this page describes how it is used.
A planned OpenID Connect provider at 2finity.com will let every 2finity domain, Migrator-generated site and partner application accept the same identity.
Contexts
Seven contexts, one identity
The contexts are relationships, not accounts. The same identity can hold several at once, in several organizations, and gains or loses them without creating or deleting anything about the person.
One identity (2finity Identity) connects out to Professional, Employee, Customer, Supplier, Partner, Administrator and Agent owner.
- Professional
- You, as yourself, across every organization you work with.
- A consultant advising three companies with one login.
- Employee
- You inside an organization that employs you.
- An editor who may change the website but not send invoices.
- Customer
- You buying from an organization.
- An order history that follows you, not the shop.
- Supplier
- You selling to or serving an organization.
- A supplier who sees the purchase orders addressed to them.
- Partner
- Your organization connected to another by agreement.
- An agency editing a client's site under a mandate.
- Administrator
- You configuring an organization and its permissions.
- The person who grants an agent its scope.
- Agent owner
- You, accountable for an agent that acts in your name.
- An agent that drafts invoices; you approve them.
Agents
Agents have identity too
An agent authenticates with its own identity and acts under permissions granted to it, not to its owner. The owner relationship makes a human or an organization accountable, and the audit log shows the agent as actor and the owner as responsible.
Sign in
Signing in today
Sign-in on 2finity.com is by invitation: an owner invites a person to a CORE, who then signs in with email and password. 2finity Identity will open Google and Microsoft sign-in as the OpenID Connect work ships.
The 2finity.dev portal has its own login. It is an interim operator login for developer tools and nothing more; it does not issue identities for the ecosystem.
The only account today is the 2finity administrator.
Extension points
Built to be replaced
Identity resolution sits behind one interface in the CORE library. The current implementation reads the administrator session; the OpenID Connect implementation is the next one; enterprise deployments plug in their own provider at the same point. Capabilities never see the difference.