Thales OneWelcome

Thales OneWelcome is an Identity and Access Management platform designed to securely manage and authenticate digital identities.

The integration between PlainID and Thales OneWelcome enables organizations to apply a continuous Authentication and Authorization process.

As an Identity Provider (IdP), Thales OneWelcome is responsible for securely authenticating users using industry-standard protocols and issuing a token that includes the user’s identity and related attributes.
The PlainID OneWelcome Authorizer extends the authentication process by dynamically evaluating fine-grained access policies defined within PlainID in real time and enriching the OneWelcome token.

The PlainID OneWelcome Authorizer enriches the OneWelcome-issued token with context-aware claims and group memberships, enabling fine-grained and consistent access control.

This is achieved by invoking the PlainID Policy Decision Point (PDP) in real time using webhooks to retrieve the relevant authorization claims for the authenticating user.

The Token Enrichment functionality is supported by both the PlainID Cloud-Based PDP, and the Hybrid, customer-hosted PlainID Policy Authorization Agent.

1. User logs in to the application.
2. The app initiates an authentication process (SSO) with Thales One Welcome (IdP).
3. As part of the authentication process, Thales One Welcome (IdP) sends a request to PlainID One Welcome Authorizer via a webhook interface to get an enriching token.
4. The PDP dynamically calculates the access decision, utilizing the Policy Information Point (PIP) to retrieve additional user or asset attributes from various data sources if required. The PlainID One Welcome Authorizer then returns the access decisions with claims for enriching the access token minted by Thales One Welcome.
5. Thales One Welcome provides the app with an access token containing the dynamically calculated access decision.