Skip to main content

Authentication

Summary​

HR Suit authenticates a portal user by resolving the correct platform or tenant account, applying account and tenant checks, verifying the password, and issuing an access token plus a refresh token associated with a device session.

Audience​

  • Platform and customer administrators
  • Support and implementation teams
  • Developers and QA engineers
  • Solution architects and security engineers

Purpose​

Authentication establishes a verified user identity and the portal, tenant, role, permission, and employee context that downstream applications use for authorized processing.

Architecture​

The gateway’s authentication target is transitional and configuration-controlled. The diagram shows the identity-service path when that path is selected.

Business concepts​

  • Client-HRMS login requires a tenant key and a tenant-associated account.
  • Super-admin login requires a platform account and the confirmed SuperAdmin role.
  • Only active identity users can complete login.
  • A tenant snapshot, when present, participates in tenant status and identity validation.
  • Successful and rejected attempts create audit or security-event records as applicable.

Technical implementation​

The login pipeline normalizes the email address, validates portal selection, resolves the account within the appropriate portal/tenant boundary, applies account-security rules, verifies the BCrypt password hash, validates the available tenant snapshot for client-HRMS users, and resets failed-access state after success.

Successful authentication creates a device-session record and builds roles and permissions from the stored user-role relationships. The service then issues a JWT access token and a hashed, persisted refresh-token record. The raw credential and stored hashes are never part of this documentation.

The gateway preserves compatible client-facing authentication routes during migration and selects either the monolith or identity service. For subsequent requests, it forwards authorization context; authentication and authorization are primarily enforced downstream.

Multi-factor configuration records exist, but a complete interactive verification flow is Requires confirmation and is not documented as completed functionality.

Confirmed source references​

  • microservices/src/identity-service/Program.cs
  • microservices/src/identity-service/Application/Auth/IdentityAuthService.cs
  • microservices/src/identity-service/Application/Auth/IdentityLoginRequest.cs
  • microservices/src/identity-service/Application/Security/BCryptIdentityPasswordHasher.cs
  • microservices/src/gateway-api/Program.cs

See Also​

Keywords​

  • Login validation
  • Identity authentication
  • Tenant authentication

Revision Information​

  • Last reviewed: 2026-07-14
  • Owner: identity-team
  • Status: Draft