User
Authorization code + PKCE at the IdP; check site and authority per action. Logout ends the designed session; issued tokens need their own revocation/expiry policy.
TRUSTED FACTORYFLOW
Developer Center. Integration you can reconcile.
Distinguish requests, events, access authority and business outcomes before connecting equipment.
GoPaperless SSO experience, domain-service authority.
Workspace → SSO → tenant/site → role/entitlement → workspace. ERP/MES/adapter identities are separate; issuer/audience, federation and Keycloak/WSO2 relationships belong in environment design.
One consistent reference IAM configuration.
GoPaperless SSO is the user entry. The table below describes an IAM reference option; components and federation follow deployment design.
| Owner | Responsibility |
|---|---|
| Keycloak | Issue tokens and manage clients, sessions and authentication. Federation/SSO is configured separately; VNeID federation is not assumed. |
| WSO2 API Manager | Bind applications and subscriptions; enforce token, scope, policy and throttling rules. |
| Domain service | Verify tenant, site, object, role and entitlement; client headers are not proof of authority. |
| Adapter / Edge | Use a separate service identity and profile authority, not a user token as equipment identity. |
Three actor types, distinct authority.
ERP/MES backend
Purpose-scoped service accounts or clients retain source IDs and correlation. Secrets stay out of the browser.
Equipment adapter
Site/profile-scoped identity with mTLS or an appropriate authentication mechanism. Restrict commands and sources through allowlists.
Requests and events follow different paths.
| Path | Reference sequence |
|---|---|
| Synchronous | Client → WSO2 → domain authorization → owned database → response |
| Async | Domain transaction + outbox → Kafka → consumer inbox/deduplication → owned transaction |
| Equipment | WCS → Fleet/Cell → Adapter/Edge → controller → callback/query → reconcile → WMS/MES |
Expiry, revocation and key rotation.
Expired tokens are rejected; domain services must recognize site-authority changes under the selected mechanism. Signing-key rotation uses discovery/JWKS and a configured compatibility window; no invented TTL or instant-revocation promise.