TechPrufer
Get started
Temporal
Temporal logoTemporal · Feature trail

Authentication and Authorization Layer

7 posts · Nov 2020 – Sep 2025

What this trail covers

Temporal Cloud's authentication and authorization layer has been enhanced with Just-In-Time (JIT) access provisioning for infrastructure, time-boxed access, and reduced blast radius. This includes implementing access hours, reducing the percentage of time engineers have access to infrastructure, and further reducing it based on specific needs. Mutual TLS anchored to customer CAs, SAML SSO, API keys, RBAC, and private connectivity options (AWS PrivateLink, Google Cloud Private Service Connect) are also key components. Secure debugging is enabled via a self-hosted Codec Server. Compliance readiness (SOC 2 Type II, HIPAA, GDPR) and operational defense in depth (SSO-gated MFA, time-boxed access, logging, auditing, pen testing) are emphasized. The platform aims to speed up teams by providing consistent security models across development and production, with proven outcomes at scale for enterprises in regulated industries.

All Temporal trails
  1. 10 reasons your CISO will love Temporal CloudThis post details enhancements to Temporal Cloud's security posture, focusing on Just-In-Time (JIT) access provisioning for infrastructure. It introduces time-boxed access with reduced engineer access percentages and emphasizes the use of Mutual TLS anchored to customer CAs, SAML SSO, API keys, RBAC, and private connectivity options (AWS PrivateLink, Google Cloud Private Service Connect). The post also highlights the self-hosted Codec Server for secure debugging, compliance readiness (SOC 2 Type II, HIPAA, GDPR), and operational defense in depth measures like SSO-gated MFA and time-boxed access. The core contribution is the detailed explanation of how these security features reduce the attack surface and enable faster, more secure shipping.
  2. Certificate generation for Temporal Cloud with tcldIntroduced the `tcld` CLI tool to securely generate CA and end-entity certificates for mTLS authentication with Temporal Cloud. This simplifies certificate management for users without existing tooling and ensures Temporal never has access to user secret keys. The post details commands for generating CA certificates, end-entity certificates, and uploading CA certificates to Temporal Cloud namespaces.
  3. Rolling out access hours at TemporalThis post details the implementation of Just-In-Time (JIT) access for Temporal engineers using Common Fate. It quantifies the security benefits of limiting access to only when needed, highlighting that engineers only require access for approximately 23.8% of the week. The post also discusses how JIT access reduces the attack surface by limiting the temporal window for exploitation, even if credentials are compromised. It advises a gradual rollout, starting with giving users what they want and then tightening scopes and implementing approvals.
  4. A deep dive into Temporal's access control strategy in AWSThis post details the challenges encountered with AWS Service Control Policies (SCPs) and IAM's Assume Role Policy Documents (ARPDs) in enforcing granular cross-account access. It highlights the unexpected behavior of SCPs with the `sts:AssumeRole` action, where an SCP applied to an account does not prevent principals outside that account from assuming roles within it, even if the assumed role's permissions are subsequently restricted by the SCP. The post also discusses the limitations of ARPDs for dynamic trust management and the lack of a formal, verifiable mechanism for account ownership, which complicates secure vendor integrations and customer trust.
  5. How it's goingThe author details their contributions to Temporal's security features, specifically focusing on the development of authentication and authorization models. This involved formulating proposals, internal discussions, implementation, and release of code. The work on security features naturally led to contributions to the Temporal Cloud effort, including onboarding paying design partners.
  7. Temporal Transparency Update #10This post details significant progress in Temporal's security features, specifically focusing on the beta launch of authentication (supporting OIDC compliant identity providers) and the release of authorization into open source. It also mentions the ongoing SOC2 process, a penetration test with minimal findings, and the addition of a security expert advisor. The removal of Kafka from visibility and cross-DC code paths is also highlighted as a key enabler for the cloud offering.
  8. Temporal Transparency Update #9: Auth is ComingThis post details the initial development and upcoming beta testing of authentication for Temporal Web. It outlines the decision-making process, including requirement gathering (SAML, LDAP, OAuth/OIDC), competitive research (Grafana's auth options, Prometheus's stance), and scope narrowing (focusing on OIDC SSO, deferring tctl auth). The implementation uses Passport.js and node-openid-client, with a configuration example provided. The post also mentions the recent V1.0 release, funding rounds, new landing page, and case studies.