Finance · Air-gapped
Single point of operator auth without DMZ
Unified operator login · MFA · session management inside an air-gapped network without external IdP/Keycloak. Hash-chain audit logs guarantee "who, when, where" traceability.
PADION
gatekeeper · Authentication · Portal
Auth · Portal · MFA · OIDC · Trust
Self-hosted Auth + OIDC IdP
governed in one place.
Login · MFA · session · IP binding · plus OIDC IdP — handle operator/user authentication and external RP integration (Trino · DataKeeper · Jupyter, etc.) in-house, without external dependencies, in air-gapped environments. Separation of duty, forced password change, and per-RP login policy are all designed to meet finance industry standards.
Auth + OIDC Sequence
- 1User → login form (ID/PW)
- 2MFA challenge (TOTP, per-client enforced)
- 3Session issued + IP binding + SoD cookie
- 4OIDC RP integration — code → token (PKCE)
- 5Validate every request (immediate revocation)
What is
Why self-hosted Auth + self-hosted OIDC IdP?
In internal environments of finance and public sector, external cloud IdPs are often not allowed. Managing authentication per-RP fragments control and breaks audit trails. In air-gapped, no-DMZ environments you need a single point of authentication responsibility while still connecting external RPs via standard OIDC.
PADION gatekeeper combines login, MFA, session, IP binding, and standard OIDC IdP flow. Operator/user authentication runs against an in-house user pool, while diverse RPs — Trino, DataKeeper, Jupyter, and more — connect through standard OAuth/OIDC.
Per-RP policy (forced reauth, per-client MFA, IP allow-list), separation of duty (operational / system zones), forced password change flow — finance compliance requirements gathered into one product.
Key Features
6 Key Features
Self-hosted user pool
In-house ID/password authentication without external IdP. Forced password change ticket flow prevents temporary-password bypass.
Multi-factor Authentication (MFA)
Standard TOTP. Per-client enforcement toggle + global role policy. Device loss re-enrollment workflow + backup codes.
OIDC IdP
Standard OIDC flow — instantly integrates with standard OIDC RPs such as Trino · DataKeeper · Jupyter.
Session + Separation of Duty
Opaque tokens · TTL · concurrent-session limits. Operational / system zone session separation isolates operator and user contexts.
Per-RP policy
Per-RP forced re-auth toggle — on forces re-login at GK every time; off allows SSO. SSO RP logout cascades to other SSO RPs.
IP binding + allow-list
IP pinned at issuance + per-client CIDR allow-list + per-user IP (inherits enrollment IP / admin override). Even stolen tokens are invalid from a different IP.
Use Cases
Deployment Scenarios
OIDC IdP
Trino · Jupyter · external RP integration
Connect data tools instantly via standard OAuth 2.0 + OIDC. Per-RP policy chooses SSO or per-request reauth per client.
Separation of Duty
Operator ↔ user context isolation
Operational / system zone session separation — prevents cascading exposure of operator credentials to RP data access. Aligned with finance supervisory regulations.
PADION integration
Delegated auth for DataKeeper · lakehouse
Sign in once at gatekeeper → other PADION products receive the same session via standard OIDC or delegated flow for consistent access control.
Tech Spec
Tech Spec
| Authentication mode | In-house ID/PW + MFA · OIDC IdP mode (standard OAuth 2.0 flow) |
|---|---|
| MFA | TOTP (RFC 6238) + backup codes. per-client enforcement toggle + Global role policy |
| Password | BCrypt hashing (salted) · password length/complexity policy · periodic expiry + reuse prevention + admin temporary-password forced change |
| Session | Opaque tokens · IP binding · concurrent-session limits · multi-context separation |
| Separation of Duty | Session separated by operational / system zone — operator and user contexts isolated |
| OIDC IdP | Standard OIDC flow (Authorization Code + PKCE · refresh rotation · back-channel logout · JWKS rotation) |
| Per-RP policy | re-auth enforcement · MFA enforcement · client-IP restriction · user-IP restriction · enrollment-IP inheritance — per-client independent setup |
| IP allow-list | Client CIDR · inherit enrollment IP · admin emergency exception · per-user / per-client IP rules |
| Audit | Tamper-proof hash chain · tamper detection · supports audit standards (finance regulations) |
| PADION integration | datakeeper · data lakehouse + external RPs (OIDC RPs such as Trino · Jupyter · Airflow) |
In the PADION Flow
Authentication step — 03
gatekeeper is step 03 — Authentication in the PADION data lifecycle, running on top of dnsd discovery to authenticate operators and users.
Self-hosted Auth + OIDC IdP —
finance-grade standards in one box.
PoC, migration consulting, OIDC RP (Trino, Jupyter, etc.) integration, and integration with other PADION products.
Weekdays 10:00–19:00 KST · info@bcore.co.kr