Select CI/CD Runner & Register OIDC Issuer
AuthHub eliminates static cloud credentials by exchanging ephemeral OIDC JSON Web Tokens (JWTs) from your CI/CD runners for short-lived downstream cloud STS tokens (RFC 8693).
GitHub Actions
Minted by GitHub OIDC token service. Validated against actions.githubusercontent.com JWKS.
GitLab CI/CD
Native GitLab pipeline ID tokens validated via gitlab.com/oauth/discovery/keys.
ArgoCD & Kubernetes
Cluster service account tokens projected to pods for GitOps infrastructure automation.
Gateway Configuration
Claim Mappings & Deterministic Machine Identity
AuthHub computes a cryptographically stable, collision-free UUIDv5 machine identity from your git repository, branch, and environment claims.
This stable UUID maps into SpiceDB Zanzibar relationship tuples without depending on mutable cloud account IDs.
SpiceDB ReBAC Governance & Cloud Targets
Configure downstream cloud roles and SpiceDB fine-grained authorization bounds. AuthHub assumes downstream roles via WebIdentity federation without holding static private keys.
definition pipeline {
relation owner: user
relation deputy: user
relation approved_runner: workload_identity
permission deploy_production = approved_runner & (owner + deputy)
permission deploy_staging = approved_runner
}
SCIM Governance Personnel & Audit Anchor
Autonomous pipelines require designated human governance personnel bound to your SCIM identity feed for IGA access certification campaigns and dual-control approvals.
👥 Designated Governance Officers
SCIM Directory: Acme Enterprise Global 2,945 Users SyncedTest Live Pipeline Controls & Activate Gateway
Verify real-time token exchange, test the Clock-1 sub-50ms pipeline freeze kill-switch, and complete registration into the tenant connections inventory.
When enabled, token exchange gracefully drains with HTTP 503 Service Unavailable for scheduled maintenance.
Emergency isolation instantly freezes rogue runner tokens in <1ms returning HTTP 403 Forbidden.
🧪 Simulated Pipeline Token Exchange Drill
Complete Onboarding & Register Gateway
Gateway will be registered in your tenant console under Connections with active ReBAC enforcement.