Authorization Management

The application keeps every access step, from the request through the periodic review to the revocation, in a sealed, verifiable record, so an audit can always see who can access which system, who approved it and when it was revoked.

Version

1.0.0

Platform

ASP.NET Core 10 and MongoDB 6+ on Windows Server or Linux

Type

Web application, self-hosted deployment

Distribution

Licensed, activated through the License Management service

Price

Custom quote

NIS2 Article 21(2) requires access control policies, periodic reviews, offboarding and multi-factor authentication, which shared spreadsheets and e-mails cannot prove after the fact.

In the register every request, approval, review and revocation is a traceable event closed with an HMAC seal, and the seal proves that the application wrote the row, so direct database access is not enough to grant an entitlement.

• Two matrices, two questions

  The access matrix shows who can use what and the device matrix shows who is responsible for it, and both can be filtered, printed and exported to Excel.

• Termination tasks

  Revocation, expiry, a failed review, offboarding, account archival and device retirement all open a task for the device owner, who confirms the closure with an entry in the audit log.

• Requesting on someone else's behalf

  A key user can submit requests for staff in their own area but cannot decide or revoke, because requesting and approving belong to separate roles.

• Sealed, tamper-evident audit log

  Every row gets a gap-free sequence number, the source IP and an HMAC-SHA512 seal, and the integrity check shows which row was altered later.

• Mandatory two-factor authentication

  Once the admin turns on MFA with TOTP replay protection, every user, including the admin, has to register an authenticator before continuing.

• Field-level encryption and key rotation

  Names, e-mail addresses and TOTP secrets are encrypted with AES-256-GCM, and rotating the field-encryption key re-encrypts every row immediately.

• IP blocking and account recovery

  Too many failed sign-ins block the IP address automatically, and one click in the log shows everything that happened from that address.

An ASP.NET Core MVC web application on .NET 10 with a Bootstrap UI, split across five projects, with a MongoDB data layer and its own MongoDB-backed Identity store.

The keys live in a key store protected by DPAPI (Windows) or an encrypted volume (Linux), mail runs on MailKit, and the installation authenticates itself against the License Management service every six hours and on every sign-in.

C# .NET 10 ASP.NET Core MVC Bootstrap MongoDB MailKit AES-256-GCM HMAC-SHA512 TOTP

• Product overview (PDF) The features and workings of Authorization Management in one document