Single sign-on– Central Identity for All Services
SecTepe.Comm has one central sign-in for all services. Your staff sign in once. Then they use chat, files and every other service securely, with no new password.
Request a demoAt a glance
- OIDC & SAML 2.0
- Two-factor login (MFA) with passkeys
- Accounts created for you (SCIM)
- Link to Active Directory
- Optional social login
- Roles & permissions
Features at a glance
Each person has one identity for all tools, for web apps, mobile apps and VPN access. So you manage accounts and access in one place. It all follows open standards and can be extended.
Identity Provider (OIDC/SAML)
Sign-in follows open standards. So it works with all modern web apps, mobile apps and machine-to-machine interfaces.
MFA & WebAuthn
Confirm the sign-in with a second factor on top of the password. Use one-time codes from an app (TOTP), FIDO2 hardware keys or passkeys. Fake login pages then come up empty.
Automatic accounts (SCIM)
When someone joins the team, accounts in every linked service are set up on their own. Changes are applied too. When someone leaves, the accounts are locked.
Active Directory & LDAP
Link your existing Active Directory or directory (LDAP). There is no need to move users. They stay where they are.
Roles & Groups
Set fine-grained access. There are areas per tenant (realms), groups and roles. Each role maps to the rights in every linked service.
Session & Token Management
See all open sessions and the sign-in history. End sessions and tokens from one place. That way you can act on an incident in seconds.
Technology & integration
One place checks sign-ins for the whole platform. All services sign users in through it, from chat and file storage to the ERP. The sign-in server starts fast and grows by adding servers. It speaks standard protocols, so it fits any modern app.
- • Proven open-source sign-in server
- • Its own database for accounts and settings
- • OIDC & SAML 2.0
- • SCIM 2.0
- • WebAuthn/FIDO2 (passkeys and hardware keys)
- • Admin API for management
Technical foundation
SecTepe.Comm uses proven open-source building blocks: Keycloak (on Quarkus) for sign-in and PostgreSQL as its database. It all runs with Docker Compose or on Kubernetes. Linked apps include Matrix for chat, Nextcloud for files and Grafana for dashboards. New passwords are checked against Have I Been Pwned.
Your benefits
- One login for the whole platform
- The same MFA rules for all
- A second factor that helps against fake login pages
- Rights and roles in one place
- Accounts are created when people join and locked when they leave
- A full log of every sign-in
How single sign-on works in practice
SecTepe.Comm runs its own build of the sign-in server. It adds four extensions: a password check, a chat sync, a block on known bad IP addresses and conditional access. Conditional access means rules decide on each sign-in. The server keeps its data in its own database. Apps such as chat, dashboards and mail sign in through OpenID Connect (OIDC).
What happens at sign-in
- The user enters a user name and password. The sign-in server then asks the identity governance service for a decision: allow, require MFA or deny.
- Rules can check groups, roles, the app, the country of the IP address, trusted networks and open sign-in risks.
- If MFA is required, the user confirms with a one-time code (TOTP) or a passkey. Users without a second factor must set up a one-time code first. SMS does not count as a factor.
- Another step can block sign-ins from IP addresses on the SecTepe threat intelligence lists.
Typical scenarios
- Existing directory: The sign-in server can link your Active Directory over an encrypted connection (LDAPS). Staff then use their usual password for mail, chat, files and dashboards.
- Partners: People from a partner sign in at their own identity provider. SAML or OIDC brings them into your login area with their roles and groups.
- Guests: A sponsor invites an outside person for a set number of days. The account is turned off when that time runs out.
- Provisioning: A SCIM 2.0 bridge takes requests from tools like Azure AD, Okta or Workday. It passes them on to the right tenant.
- Chat accounts: Add a user to the chat group, and the chat account is created right away. Remove the user, and it is deactivated.
Passwords, operation and data control
New passwords need at least 14 characters and a mix of character types. The last five passwords cannot be reused. Each new password is also checked against a public database of leaked passwords. Only a short piece of its hash leaves the server, never the password. Your own block list can ban more passwords.
Each tenant gets its own login area (realm). A provisioning token for one tenant cannot write into the area of another tenant. You run the stack yourself, in a simple container setup or on Kubernetes. On Kubernetes, the sign-in server runs at least twice. Its database is a cluster with two instances.
Common questions
Can we test a policy before it takes effect? Yes. New conditional access policies start in report-only mode. The log shows what they would have done. A what-if check also tests a planned sign-in against the active rules.
Can people sign in without a password? Yes. A setup script turns on passwordless sign-in with FIDO2 passkeys. Users then register a passkey at their next sign-in.
Can the login page show our own brand? Yes. A white-label theme takes your name, logo, main color and legal links from settings.
Ready for SSO & Identity?
We set up central sign-in and connect your apps. We also put the same MFA rules in place for every service.
How we work with you
We want to work with you for the long run, not just deliver once. Our way of working has four steps. So you always know what comes next, who does what and what you get.
1. Free initial conversation
We learn where you stand and what you want. In 30 to 45 minutes we check if we are a good fit. We show you options and answer your questions. There is no obligation.
2. Current state review
We check where you stand today: tech, processes and rules. You get a list of strengths and gaps, sorted by urgency. Our offer is based on it.
3. Delivery with a dedicated lead
An experienced lead guides you through the project. You get clear goals, an open plan for time and cost, and a status every week. All results are written down and belong to you.
4. Running and reviewing
After the project we stay with you. We run systems for you, check them at set times and keep track of open tasks. When new threats or new rules come up, we get in touch.
Common questions
We hear these questions most often in a first call. For anything else, write to hello@sectepe.de or give us a call.
- How do we start working with SecTepe?
- Every project starts with a free first call. Then you get an offer with scope, timeline and result. If you like, we start small with a pilot. That way you get to know us before the real work starts.
- What company sizes and sectors do you support?
- We work for small and mid-sized firms, for parts of large groups and for operators of critical infrastructure (KRITIS). Often that means industry, trades, health, banks, energy and public bodies. Our focus is mid-sized firms in Germany, Austria and Switzerland.
- Do you work on site, remotely or hybrid?
- Both. Reviews, advice and most services run remotely from German data centers. For workshops, training and emergencies we come to you, mainly in North Rhine-Westphalia, the Rhineland and the Ruhr area. We travel further when needed.
- Which standards and regulations do you cover?
- We work to ISO 27001:2022, BSI IT-Grundschutz, TISAX, B3S KRITIS, NIS2 and DORA, plus sector-specific rules. Our methods build on known frameworks such as NIST CSF, MITRE ATT&CK, OWASP and OSSTMM. We combine them to fit each project.
- How do you protect the confidentiality of my data?
- By contract and by technology. Before every project, both sides sign a non-disclosure agreement. Your data stays in German data centers. Every access needs a second login factor and is checked one by one. Our whole team is bound to secrecy by contract and under the GDPR.