PKPEEK Docs
Docs/Customers & tenants

Agency identity and sign-in

Screen 1.8 — register and validate the agency’s trusted identity provider, assurance requirements (MFA, CAC/PIV) and session policy.

PEEK Platform Administrator

/peek/customers/tenant-a/1-8
Live walkthrough · Agency identity and sign-in
/peek/customers/tenant-a/1-8

Agency users sign in through their own agency identity provider. On 1.8 you register the trusted issuer and audience (for the demo tenant: audience pdcc-agency:tenant-a), required assurance claims, MFA and CAC/PIV requirements, recovery and session policy, then run an isolated sign-in validation before submitting the profile for release.

  1. 1

    Register metadata

    Enter trusted issuer, audience and subject mapping.

  2. 2

    Set assurance

    Require MFA and CAC/PIV as the agency specifies. Alternative login paths may not silently weaken assurance.

  3. 3

    Validate

    Run the isolated sign-in validation. Issuer, audience, subject mapping, certificate validity and assurance must all pass.

  4. 4

    Publish

    Validate and publish identity configuration creates a versioned identity profile; activation readiness uses this test evidence.

1.8 · Agency Identity & Sign-in

Configure and verify the agency identity boundary. Open it at /peek/customers/tenant-a/1-8 (any tenant ID you can access works in place of tenant-a). The primary action is Validate and publish identity configuration, which requires identity.configure.

How 1.8 works

  1. 1. Register trusted agency identity metadata, required assurance and recovery policy

  2. 2. Run isolated sign-in validation and submit for release

Screen 1.8 contract

Fields shown
Trusted issuer, audience, assurance claims, MFA, CAC/PIV, session policy
Primary action
Validate and publish identity configuration
Required capability
identity.configure
Validation
Issuer, audience, subject mapping, certificate validity and agency-required MFA or CAC/PIV assurance must pass. Alternative login cannot silently weaken assurance.
Successful outcome
Published identity profile is versioned; readiness uses test evidence and initial-admin verification.
Screen states
Loading; empty; ready; restricted; stale; error; review pending
Audit event
admin.screen.1.8.action (acceptance test AT-UI-1.8)
Requirements
R02, R03, R06, R28, SYS02, SYS04, SYS06, SYS10, SYS11, SYS20, SYS23, UI-1.8
Boundary — Validate agency IdP evidence and prohibit weak fallback or public self-registration.
Rejected even if the browser allows it — Return an identity assertion from the wrong issuer or lacking required assurance; deny sign-in and activation.

Related guides

Initial agency administrator handoff

Screen 1.9 — activate the agency-designated initial administrator through an independently verified, bounded acceptance flow.

Activation readiness and completion

Screens 1.5 and 1.5A — evaluate readiness blockers for the purchased configuration, activate the tenant and read the activation receipt.

Signing in to the PEEK center

Workforce identity sign-in with phishing-resistant MFA, session expiry, sign-out and the boundary-testing options.