PKPEEK Docs
Docs/Getting started

Signing in to the PEEK center

Workforce identity sign-in with phishing-resistant MFA, session expiry, sign-out and the boundary-testing options.

All PEEK operators

/peek/signin
Live walkthrough · Signing in to the PEEK center
/peek/signin

The PEEK center is reached at /peek/signin. There is no password, no public self-registration and no weaker fallback. In this non-production profile a synthetic fixture identity provider (issuer https://peek-idp.example.invalid) signs assertions so every boundary case can be demonstrated; production uses the published PEEK workforce IdP.

Sign in

  1. 1

    Choose a synthetic identity

    Pick an operator from Synthetic identity. Each lists its PEEK roles (for example *PEEK Preparer — PEEK Platform Administrator*).

  2. 2

    Complete the authenticator challenge

    Leave Multi-factor authentication completed and Phishing-resistant authenticator checked. Clear either to test the assurance failure path — access is denied without a weaker fallback.

  3. 3

    Sign in

    The center loads your operator profile (session.me) and the tenants you are assigned, then opens the Customer Directory (or the page in ?next=).

Sign-in form

Synthetic identity
Fixture PEEK workforce identity (subjects demo-p01…demo-p07).
Multi-factor authentication completed
Required assurance. Clearing it produces a denied sign-in.
Phishing-resistant authenticator
Required for PEEK operators (agency users present CAC/PIV instead).
Boundary testing options
Issuer override and Audience override let you send an assertion from the wrong issuer or for the wrong audience; both must be refused.

Demonstration operators

OperatorSubjectRoleCustomer scope
PEEK Preparerdemo-p01PEEK Platform AdministratorAll customers
PEEK Reviewerdemo-p02PEEK Technical ReviewerAll customers
PEEK Reviewer Twodemo-p03PEEK Technical ReviewerAll customers
PEEK Entitlement Admindemo-p04PEEK Entitlement AdministratorAll customers
PEEK Support Operatordemo-p05PEEK Support OperatorAll customers
PEEK Incident Operatordemo-p06PEEK Incident Operatortenant-a only
Unassigned Incident Operatordemo-p07PEEK Incident OperatorNo customers (tests out-of-scope denial)

Sessions and sign-out

  • If your session expires, any request returns you to /peek/signin?expired=1&next=… so you land back where you were.
  • Sign out (operator menu) ends the server session and clears all pdcc:* workspace drafts from this browser tab.
  • Sign-in is refused for revoked, expired or not-yet-valid operator assignments. Revocation ends active sessions immediately.
  • Account recovery is performed by your identity provider and must restore the required assurance level.

Related guides

Operator roles and capabilities

The five PEEK platform roles, the capabilities each one holds, and how capabilities gate screens and actions.

Operator assignments

Propose, independently review and revoke PEEK operator role grants, customer scope and validity windows.

PEEK Administration Center overview

The internal PEEK operator portal that governs commercial capability, platform boundaries and technical release for every agency customer — 68 contract-driven screens in eight groups.