TokenTimer Enterprise

TokenTimer Enterprise is the licensed self-hosted variant of TokenTimer. It runs the same core product (token and certificate expiration tracking, alerting workers, dashboard) and adds the capabilities larger organizations need to operate it against their identity infrastructure.

What Enterprise adds over Core

• Single sign-on: multiple SAML 2.0 and OpenID Connect providers side by side, with identity provider (IdP) group to role mappings (Entra ID, Okta, Keycloak, and more), an identity model that survives email renames, and audit logging of every login and membership sync.
• Registry access: prebuilt, hardened container images, an OCI Helm chart, and a delivery tarball pulled from the private TokenTimer registry (harbor.tokentimer.ch) with pull-only credentials. No build toolchain or source access is required.
• Licensing: a signed license file, verified offline, gates enterprise features. No runtime communication with TokenTimer and no telemetry. Technical details (RS256 JWT, feature:oidc / feature:saml entitlements) are in the Configuration reference.

To obtain a license or an evaluation, contact support@tokentimer.ch.

Main sections

• Registry access: pull images, the Helm chart, and the delivery tarball; create pull secrets; rotate credentials.
• Installation: install and upgrade TokenTimer Enterprise with Docker Compose or Helm, apply the license, and verify the deployment.
• Architecture overview: components, deployment topology, data flow, network requirements, and the security model.
• Configuration reference: enterprise environment variables, license resolution, SSO bootstrap, and the secrets keyring.
• Single sign-on: quickstarts, the identity model, claim mapping, group to role mappings, and per-IdP setup guides (Microsoft Entra ID, Okta, Keycloak, Google Workspace, Auth0, Amazon Cognito, AD FS).
• Authentication model: what Enterprise adds to the Core authentication model, admin bootstrap modes, RBAC, and audit logging.