GoPaperless SSO
Shared identity for four portals; business authority remains organization- and project-scoped.
Continue in the ecosystem
Trusted Records ecosystem
Identity, permitted shared information and signing transactions connect to records under explicit purpose and authority.
Read detailsAPI authentication and authorization
OAuth scopes govern API access; tenant/project and records policy still govern business authorization.
Read detailsPrivacy and records data
Separate website information from owner-provided records data; establish purposes, grounds and roles.
Read detailsOne authentication entry, four workspaces
Access the four portals
GoPaperless SSO is the shared authentication entry in the architecture; each portal authorizes organization and project access.
Read detailsFour portals, clear roles
Separate execution, oversight and approvals across the same records lifecycle.
Read detailsAPI authentication and authorization
OAuth scopes govern API access; tenant/project and records policy still govern business authorization.
Read detailsConnection scope
Keycloak-based GoPaperless SSO appears in the source architecture. Agree realms/clients, issuer, audience, sessions and federation for deployment; do not publish unapproved endpoints or secrets.
Business journey
Login result → subject/organization mapping → role check → portal session. Revocation or session expiry must be handled before the next action.
Exceptions and revocation
Expired sessions or missing organization mappings: stop the action and request reauthentication or admin help; never silently grant fallback access.
Minimum evidence
Retain subject references, organization/project, purpose, session/transaction, validity, decision and associated records. Do not log tokens, secrets or unnecessary shared attributes.
Continue the workflow
Two journeys, one records lifecycle
Connect paper and born-digital records through persistent identifiers, policies and evidence.
Read detailsIntegration quickstart
Exercise ingest → job tracking → registration → verification with synthetic data.
Read detailsIntegrity, provenance and evidence
Each evidence type answers a different question; hashes, timestamps and approvals are not interchangeable.
Read detailsStart with a verifiable scope.
Agree record classes, quality criteria, permissions and evidence before scaling.
Plan assessment