Authentication and Authorization Layer

9/30/2025

This post details ten reasons why CISOs will love Temporal Cloud, focusing on security and operational aspects. It highlights that sensitive payloads are encrypted in the user's environment with their keys, Temporal Cloud never calls into the user's network, mutual TLS anchored to the user's CA secures Namespace endpoints, SAML SSO and API keys are supported for enterprise authentication with RBAC, and private connectivity options like AWS PrivateLink and Google Cloud Private Service Connect are available. It also describes a Codec Server for secure debugging, compliance readiness (SOC 2 Type II, HIPAA, GDPR), operational defense in depth with JIT access and audits, and how security features speed up teams by working consistently across development and production. The post concludes by emphasizing that Temporal Cloud keeps code and plaintext data in the user's environment, authenticates calls with mTLS, supports private connectivity, and provides secure visibility.

7/19/2023

This post introduces the `tcld` CLI tool's new capabilities for generating CA and end-entity certificates, simplifying mTLS setup for Temporal Cloud. It provides specific command-line examples for generating certificates and uploading CA certificates to namespaces, along with links to relevant documentation for Go, Java, PHP, Python, TypeScript, and .NET SDKs.

5/30/2023

This post details the implementation of Just-In-Time (JIT) access for engineers to Temporal's infrastructure, specifically focusing on access hours and reducing the overall time users have elevated permissions. It quantifies the security benefits of limiting access to only when needed, highlighting a reduction from 100% access time to approximately 23.8% of the week, and further potential reductions based on actual usage. The post also discusses the security implications of daily rotating AWS access tokens and the benefits of implementing approval workflows for access requests, all contributing to a stronger security posture by reducing the attack surface and making it harder for attackers to exploit compromised credentials.

6/6/2022

This post details an in-depth investigation into AWS SCPs and their practical application for implementing a Biba-style access control model. It highlights a critical misunderstanding of how SCPs interact with the `sts:AssumeRole` API, demonstrating that SCPs do not prevent the issuance of credentials for cross-account role assumption, even when an SCP denies all actions. The post also discusses the limitations of SCPs in managing trust relationships with external accounts and vendors, and the operational overhead involved in manually updating Assume Role Policy Documents.

3/31/2021

This post details the author's contributions to Temporal's security features, specifically focusing on the development of the authorization model for Temporal Server and subsequent contributions to the nascent Temporal Cloud effort. It highlights the process of formulating proposals, internal discussions, implementation, and release of security-related code, and mentions the onboarding of design partners to Temporal Cloud.

2/19/2021

This post details the significant progress made in securing Temporal, focusing on the introduction of authentication and authorization features for both open-source and cloud offerings. For open-source Temporal, authentication now supports any OIDC-compliant identity provider, and a robust authorization system has been implemented. The cloud offering has also seen immense progress in security, including SOC2 compliance efforts and penetration testing. The post highlights the prioritization of security features based on user feedback and the strategic decision to focus on cloud as the primary revenue model to improve developer accessibility.

11/6/2020

This post details the initial development phase of Temporal's authentication and authorization layer. It outlines the 'converge/diverge' process for feature development, including requirement collection via Notion, research into comparable products (e.g., Grafana, Prometheus), and internal discussions leading to the decision to prioritize OIDC Single Sign-On. The technical implementation will leverage Passport.js and node-openid-client, with a configuration example provided. The post also announces a beta testing program.