Enterprise SSO
Microsoft Entra ID
Modern enterprise authentication through OpenID Connect and the OAuth 2.0 authorization-code flow.
Architecture Demos
Choose a capability, run one focused demonstration, and inspect what happened.
SSO
Sign in with Microsoft Entra ID or Google OpenID Connect and inspect the validated application identity.
Single sign-on
Microsoft Entra ID and Google use OpenID Connect to validate sign-in before application authorization.
This clears your WizardGang session and sign-in flow cookies. Microsoft, Google, and GitHub retain their own sessions.
Sign in
Choose a trust relationship
Credentials and protocol secrets stay on the Worker.
OpenID Connect
Standard Google-account authentication with no Workspace or organizational-domain assumption.
Authenticated
Identity
ProviderAuthenticated
Received → validated
Validated provider payload
Application contract
Normalized identity
Only fields legitimately derived from validated provider data cross this boundary.
Application authorization
What can this identity do?
Authenticated identity
demo:read → authenticated identity
demo:write → authenticated identity, visitor sandbox only
caller-selected namespaces → managed operator credential only
demo:write → authenticated identity, visitor sandbox only
caller-selected namespaces → managed operator credential only
Trust evidence