Authentication & Authorization

Polyaxon provides robust mechanisms for both authenticating users and authorizing their access to specific resources within the platform.

Authentication

Authentication verifies the identity of a user attempting to access Polyaxon.

Please refer to the following documentation pages for more details:

In addition to password login, Polyaxon supports two-factor authentication (2FA) which provides an added layer of security via a time-based one-time password algorithm (TOTP). We encourage 2FA as an important step towards securing data access from intruders. Polyaxon users can deploy universal second-factor devices like YubiKeys (which can also be used to confirm the sudo prompt), TOTP apps like Google Authenticator, or SMS as second factors. This also applies to sign-in with an SSO provider.

Single Sign-On

Polyaxon's single sign-on (SSO) implementation prioritizes security. We aggressively monitor linked accounts and disable them with any reasonable sign that the account's access has been revoked. SSO also improves user experience by streamlining login and improving access from trusted domains. Polyaxon currently offers SSO via Google Apps for Work and GitHub Organizations.

SAML 2.0

To facilitate user authentication through the web browser and improve identity management, Polyaxon offers assertion markup language (SAML)-based SSO as a standard feature to customers on its Enterprise plan. SAML 2.0 enhances user-based security and streamlines signup and login from trusted portals to enhance user experience, access management, and auditability.

Polyaxon integrates with SAML 2.0 providers including OneLogin, Auth0, and Okta.

Authorization (RBAC)

Polyaxon supports Role-based Access Control (RBAC). Please refer to the dedicated RBAC documentation for a detailed explanation of roles, permissions, and how to manage user access within organizations and projects.

Audit Controls

We know user administration is central to security and management, and auditing user logs is often the first step in both an emergency response plan and policy compliance requirements. All Polyaxon customers get admin controls governing identity, access, and usage to keep your data safe, secure, and centrally managed.

Membership within Polyaxon is handled at the organization level. The system is designed so each user has a singular account that can be reused across multiple organizations (even those using SSO). Each Polyaxon user should have their own account and can choose their own personal preferences and notifications settings. Access to organizations is dictated by role:

Outsider
Viewer
Member
Admin
Manager
Owner
Billing

The member list includes the username, email, status, added date, teams, and role for each user. The admin or owner can revoke access by project, team, or org and change the user role. Additionally, the owner can request login and password history and revoke passwords and active sessions for any user via request to Polyaxon Support.

In the audit log, all of the actions by user and action within the Polyaxon UI (e.g., member.invite, project.create) are listed chronologically by time so you'll always have a view into your organization's most recent history.