Skip to content
NEXTBIT

Axis 04 · Interoperability & security

Identity and access (IAM)

Single sign-on and multi-factor authentication, privileged accounts (PAM), directories, PKI and electronic signature.

The challenge

Each application has its own accounts and passwords, and staff departures are not always followed by removal of their access.

Identity and access management gives each user a single identity and rights that match their role. NEXTBIT sets up single sign-on (SSO) and multi-factor authentication with Keycloak, connected to your directories, protects privileged accounts and secrets with Vault, and deploys a PKI for certificates and electronic signature. We start from an inventory of your accounts and applications, connect a pilot application first, then extend the system in stages, without blocking your teams' work.

What we do

  • Single sign-on (SSO) across your applications with Keycloak, via OpenID Connect or SAML.
  • Multi-factor authentication for sensitive, remote or privileged access.
  • Privileged account management (PAM) and application secrets with Vault.
  • Directory consolidation and joiner, mover and leaver processes.
  • Internal PKI for certificates and integration of electronic signature.

Our approach

  1. 01

    Access diagnostic

    Inventory of accounts, directories, applications and the rights actually in use.

  2. 02

    Model design

    Roles, access rules, authentication levels and the Keycloak and Vault architecture.

  3. 03

    Pilot

    Connection of a first application and a group of users, measured against the agreed criteria.

  4. 04

    Rollout and handover

    Extension in waves to other applications, documentation, training and post-delivery support.

What you gain

  • One account per user, disabled in one step when they leave.
  • Privileged accounts that are controlled and traced.
  • Fewer passwords to remember and reset.
  • A clear view of who accesses what.

Frequently asked questions

Can our older applications use single sign-on?

In most cases, yes. Recent applications connect through OpenID Connect or SAML. For older ones, we use a synchronised LDAP directory or an authentication proxy placed in front of them. The diagnostic states the chosen approach for each application.

Will multi-factor authentication slow users down?

We apply it according to risk: it is required for remote access, privileged accounts and sensitive operations, and stays lighter for a known device on the internal network. Thanks to single sign-on, users only log in once per session.

Why open solutions such as Keycloak and Vault?

They are proven, widely documented and install in your own infrastructure, with no per-user licence. You keep control of your identities and keys. If your context justifies another solution, we recommend it with full neutrality.

Related offers

Interoperability & security