Enhancement: Shared Signals Framework Receiver - New Event Types and More!

The SailPoint Shared Signals Framework (SSF) receiver now supports Continuous Access Evaluation Profile (CAEP) events, including Session Revoked and Credential Change. Additionally, you can now customize the format of the Subject ID for the SSF Receiver and use OAuth 2.0 JWT - Client Credential grant type for authentication.

Description

The SailPoint Shared Signals Framework (SSF) Receiver now supports the CAEP events Session Revoked and Credential Change. When a security event is received, it is enriched with the identity context by automatically correlating it to an identity.

CAEP Session Revoked Events

• Session Revoked events are standardized security signals used to immediately terminate user sessions across different applications and services. As part of the Shared Signals Framework, this event type allows an Identity Provider (IdP) to tell a Service Provider (SP) that a user’s session is no longer valid, ensuring that access is revoked in real-time rather than waiting for token expiration.
• For example,
  • A contractor’s contract ends at 5:00 PM on Friday. HR updates the identity system, setting the user to inactive. The Identity Provider immediately triggers a session-revoked event to all subscribed applications (e.g., Salesforce, GitHub, Slack). Even if the contractor is logged into Salesforce and GitHub, those systems receive the signal and immediately terminate the active session, preventing further access.
  • A user’s credentials are leaked, or a Threat Intelligence system detects suspicious login behavior from a strange location. The security system triggers a session-revoked event for the user. The SaaS applications (e.g., Okta) receive the signal, which results in the invalidation of all active sessions and refresh tokens, requiring the user to re-authenticate with higher-assurance credentials.
  • A user’s laptop is connected to corporate systems, but the Malware Detection System or MDM detects that the firewall has been disabled or a malicious app was installed. The MDM notifies the IdP and SaaS apps via a CAEP event, indicating a Device Compliance Change that warrants an immediate session-revoked event. Applications like Slack or Jira automatically terminate the session, preventing the user from accessing corporate data until the device is remediated.
  • A security admin identifies that a user is part of a security incident and must be removed from all systems immediately. The admin revokes the user’s refresh tokens in their IdP, which triggers a revocation signal to downstream service providers. The service provider immediately rejects the next API call or access request from that user.

CAEP Credential Change Events

• Credential Change event is a standardized security signal sent from an Identity Provider (IdP) or service to relying parties (applications) to indicate that a user’s authentication credentials have been modified. This event enables immediate, real-time security action, such as terminating active sessions, in response to potential account compromises or administrative actions.
• For example,
  • If an administrator detects an account compromise and forces a password reset, a credential change event is sent, triggering immediate termination of all active sessions across connected applications.
  • If a user’s credentials are changed or revoked during off-boarding, CAEP ensures that access is immediately revoked, rather than waiting for a session token to expire.
  • A user changing their registered MFA device might trigger a credential change event, prompting apps to require a fresh, high-assurance authentication.

Workflow Triggers and Templates

CAEP Session Revoked

CAEP Credential Change

• This support includes two Workflow triggers and two Workflows templates:
  • CAEP Session Revoked trigger: Initiates a workflow when a CAEP Session Revoked event is received.
  • CAEP Credential Change trigger: Initiates a workflow when a CAEP Credential Change event is received.
  • Remove Access When a Session is Revoked template: This workflow is triggered when a CAEP Session Revoked event is received and disables the identity’s accounts in response to a potential threat.
  • Remove Access When Credential Changes: This workflow is triggered when a CAEP credential Change event is received showing the identity’s credential was revoked. The workflow disables the identity’s accounts in response to a potential threat.

Support iss_sub format for Subject Identifier

• Subject identification in the Shared Signals Framework Receiver now supports the Issuer and Subject Identifier Format (iss_sub) in addition to the Email Identifier format. You can set the Subject ID to the Account ID of a selected Source so that events are correlated with Identities through the associated account; otherwise the user’s email address is used as the Subject ID.

Support JWT Authentication Types

• SSF Receiver now supports JWT - Client Credentials grant type.
• This provides additional flexibility to connect with systems that supports OAuth 2.0 client credentials grant type.

Documentation

• Shared Signals Framework
  • Managing Receivers
• Workflow Triggers
• Workflow Templates

Release Details

• Identity Security Cloud - Available (SaaS).

Note: Atlas Enterprise features are available for add-on purchase for Business and Business Plus customers. Please contact your CSM for more information!

To ask questions and learn more please visit the Developer Community.