Temporal Authentication
You set up temporal authentication by checking client certificates or user tokens on every request. This process confirms who can start, read, or stop workflows in your cluster. Most teams start by sharing one broad admin role across their whole engineering group. When permissions are too wide, any developer or worker can stop live workflows by mistake. Shared keys also make it hard to see which person triggered a bad state change. How temporal authentication works in practice The platform sp
Multi-Factor Authentication (MFA): the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You set up temporal authentication by checking client certificates or user tokens on every request. This process confirms who can start, read, or stop workflows in your cluster. Most teams start by sharing one broad admin role across their whole engineering group. When permissions are too wide, any developer or worker can stop live workflows by mistake. Shared keys also make it hard to see which person triggered a bad state change.
How temporal authentication works in practice
The platform splits identity checks into two parts. First, it verifies the identity of the caller. Second, it checks what actions that caller can run in a namespace. In a self-hosted setup, you can supply custom claim mappers and authorizer plugins. The claim mapper reads a token or certificate from the incoming network call. It translates that identity into a set of permissions for the system.
Then the authorizer plugin runs before the server processes the API call. It checks the caller role against the target namespace and the requested action. Teams use mutual TLS to secure machine traffic between worker processes and the server. Every worker presents a valid client certificate to prove its identity during the handshake. For human users on the web UI or command line, teams connect single sign-on providers. The provider issues JSON web tokens that carry user group data on each call.
Configuring roles for namespaces and workers
Namespaces isolate workflows so different teams do not step on each other. Good role design maps each namespace to a specific set of worker and user roles. A worker service only needs permission to poll task queues and write workflow history. It should not have permission to delete namespaces or change cluster settings.
Human operators need different rules based on their daily jobs. Most developers only need read permissions to view workflow state and debug failed runs. Senior engineers may need write permissions to reset stuck workflows or send manual signals. Platform admins hold the highest role to create namespaces and manage retention rules. Rotating client certificates and keeping token lifetimes short reduces the risk of stolen keys.
Multi-Factor Authentication (MFA): architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
What native controls solve and what keeps the session active
Native identity checks do a great job of blocking unknown callers at the door. Mutual TLS and token checks prove who is logging in to the cluster. Namespace roles limit which teams can touch specific groups of workflows. These controls are essential first steps for any production setup.
Still, login checks only decide who can enter the namespace. They do not inspect the payload data inside individual commands or workflow signals. Once a user has write permissions, they can terminate any workflow in that namespace. Native roles also do not mask sensitive data like emails or card numbers in payloads. When developers view workflow history in the UI, raw customer data often appears in plain text. Masking rewrites matched fields in results so sensitive values stay safe during debugging. Teams also need clear audit logs that tie every manual command to a real person.
Govern statements and responses across databases and APIs
Good config and scoped roles are needed setup. They do not check single queries in flight or mask sensitive fields in returned rows. Across Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, and internal HTTP endpoints, hoop.dev runs beside each supported service as an open-source proxy, a sidecar for your database or API.
First, hoop.dev guardrails block banned queries before they run. Then hoop.dev data masking rewrites matched sensitive values in responses in memory. The audit trail records every statement and verdict per resource. Furthermore, hoop.dev holds SOC 2 Type II and is open source on GitHub.
Frequently asked questions
What is the difference between mutual TLS and token login in Temporal?
Mutual TLS uses certificates to verify machine traffic between workers and the cluster. Token login uses identity providers to check human users on the UI or CLI.
How do you limit what a developer can do in a namespace?
You assign the developer a read-only role for that specific namespace. This role lets them view workflow history without starting or stopping live runs.
Can native roles hide sensitive payload data from the web UI?
No, native roles only control who can read or write to a namespace. Hiding specific fields like phone numbers requires payload encryption or data masking tools.