The Graphwise Platform Security Model in a Nutshell

The Graphwise Platform Security Model ensures:

Centralized IdP (Keycloak) for all applications with a single realm per environment
Seamless SSO across the suite with shared identity and permissions
External M2M access via client credentials
Identity federation for end users
Strict audience-scoped tokens to minimize size and scope
HTTPS, token expiry, key rotation; no hard-coded secrets

All applications authenticate via one Keycloak realm (OIDC); no local user stores in applications
Disabling a user in Keycloak revokes access to all applications
Logging into one application grants access to others (SSO); global logout invalidates the SSO session
Roles and claims are centrally defined in Keycloak; services enforce authorization from token claims; changes apply immediately
All service-to-service calls require valid Keycloak tokens (client credentials)
External IdPs (Azure AD/Entra ID, LDAP, SAML) are supported; roles are mapped in Keycloak

Refer to the original Keycloak documentation for more details.