Skip to main content
Version: 0.8

TokenTimer Enterprise

TokenTimer Enterprise is the licensed self-hosted variant of TokenTimer. It runs the same core product (token and certificate expiration tracking, alerting workers, dashboard) and adds the capabilities larger organizations need to operate it against their identity infrastructure.

What Enterprise adds over Core​

  • Single sign-on: multiple SAML 2.0 and OpenID Connect providers side by side, with IdP group to role mappings, a subject-first identity model that survives email renames, and audit logging of every login and membership sync.
  • Registry access: prebuilt, hardened container images, an OCI Helm chart, and a delivery tarball pulled from the private TokenTimer registry (harbor.tokentimer.ch) with pull-only robot credentials. No build toolchain or source access is required.
  • Licensing: an offline-verified, RS256-signed license JWT gates enterprise features (feature:oidc, feature:saml, integration entitlements). No runtime communication with TokenTimer and no telemetry.

Main sections​

  • Registry access: pull images, the Helm chart, and the delivery tarball; create pull secrets; rotate credentials.
  • Installation: install and upgrade TokenTimer Enterprise with Docker Compose or Helm, apply the license, and verify the deployment.
  • Architecture overview: components, deployment topology, data flow, network requirements, and the security model.
  • Configuration reference: enterprise environment variables, license resolution, SSO bootstrap, and the secrets keyring.
  • Single sign-on: quickstarts, the identity model, claim mapping, group to role mappings, and per-IdP setup guides (Microsoft Entra ID, Okta, Keycloak, Google Workspace, Auth0, Amazon Cognito, AD FS).
  • Authentication model: what Enterprise adds to the Core authentication model, admin bootstrap modes, RBAC, and audit logging.