Authentication
The Companion Agent is the secure authentication bridge between the user's identity provider, the browser, and the OSDF viewer. It holds the user's session so individual applications never have to, and it issues short-lived assertions that prove identity and device trust together.
Session model
- The user signs in once through your identity provider (Microsoft Entra ID, Okta, OIDC, SAML, or PIV/CAC).
- The Agent stores the resulting session material in the platform credential store (DPAPI, Keychain, or Secret Service) - never in plaintext on disk.
- Applications request session assertions from the Agent rather than handling tokens directly.
Sessions stay in the Agent
Relying parties receive only short-lived, audience-bound assertions. The long-lived IdP session never leaves the Agent's custody.
Session assertions
Assertions are signed by the device key and carry the claims needed for a single access decision:
| Claim | Meaning |
|---|---|
sub | The authenticated user (pseudonymous subject identifier). |
aud | The single relying party the assertion is valid for. |
dev | The device identity thumbprint (hardware-backed key). |
pos | A compact device-posture summary at issuance time. |
iat / exp | Issued-at and a short expiry (seconds to minutes). |
jti | Unique ID for replay detection and audit correlation. |
json
{ "sub": "u_3a9f…", "aud": "viewer.osdfsystems.com", "dev": "tpm:9c2e…", "pos": { "managed": true, "edr": "ok", "disk": "encrypted" }, "iat": 1771866600, "exp": 1771866720, "jti": "asrt_71b…"}Properties
- Audience-bound - an assertion minted for one relying party is rejected by any other.
- Short-lived - TTLs are measured in seconds to a few minutes, limiting the value of a captured assertion.
- Device-bound - the
devclaim ties the assertion to the hardware key; it is meaningless on another machine. - Phishing-resistant - for admin and high-assurance flows, the Agent requires hardware-backed credentials (PIV/CAC or platform authenticators).
Re-authentication
When a session expires, posture degrades, or a lease is revoked, the Agent moves to the Locked state and prompts for re-authentication. Until trust is re-established, access decisions fail closed.
Continue to device identity for how the
dev claim is produced and attested.