Skip to main content
Version: 0.15

TokenTimer Enterprise

TokenTimer Enterprise is the licensed self-hosted variant of TokenTimer. It runs the same core product (token and certificate expiration tracking, alerting workers, dashboard) and adds SSO, Harbor-delivered images, expanded auto-sync, and CertOps compliance reporting.

What Enterprise adds over Core​

  • Single sign-on: multiple SAML 2.0 and OpenID Connect providers side by side, with identity provider (IdP) group to role mappings (Entra ID, Okta, Keycloak, and more), an identity model that survives email renames, and audit logging of every login and membership sync.
  • Scheduled auto-sync: GitHub and GitLab re-scans from Core, plus license-gated scheduled sync for AWS, Azure, GCP, Vault, and Microsoft Entra ID. TokenTimer Cloud never stores integration credentials and has no auto-sync.
  • CertOps compliance reporting: evidence classification, key locality, and change-ticket coverage, gated by feature:certops-compliance. The base CertOps inventory, agent protocol, and executor API are ungated, same as self-hosted.
  • Registry access: prebuilt, hardened container images, an OCI Helm chart, and a delivery tarball pulled from the private TokenTimer registry (harbor.tokentimer.ch) with pull-only credentials. No build toolchain or source access is required.
  • Licensing: a signed license file, verified offline, gates enterprise features (feature:oidc, feature:saml, feature:certops-compliance, and per-provider integration:* auto-sync). No runtime communication with TokenTimer and no telemetry. Details are in the Configuration reference.

To obtain a license or an evaluation, contact support@tokentimer.ch.

Main sections​

  • Registry access: pull images, the Helm chart, and the delivery tarball; create pull secrets; rotate credentials.
  • Installation: install and upgrade TokenTimer Enterprise with Docker Compose or Helm, apply the license, and verify the deployment.
  • Architecture overview: components, deployment topology, data flow, network requirements, and the security model.
  • Configuration reference: enterprise environment variables, license resolution, SSO bootstrap, and the secrets keyring.
  • Certificate operations (CertOps): licensing model, deployment topology, agent protocol, and the Enterprise-only compliance reporting layer.
  • Single sign-on: quickstarts, the identity model, claim mapping, group to role mappings, and per-IdP setup guides (Microsoft Entra ID, Okta, Keycloak, Google Workspace, Auth0, Amazon Cognito, AD FS).
  • Authentication model: what Enterprise adds to the Core authentication model, admin bootstrap modes, RBAC, and audit logging.