SSO and User Management

This page is a placeholder.

Where appropriate, Hint can support identity and user-management patterns that reduce friction when users move between Hint and partner systems (for example, SSO and user provisioning).

Partner role matching

Your app defines its own role names. Hint stores those names against each user who has access to your product and sends them in the handshake as user.partner_roles. Your app applies its own permissions from there.

Hint authenticates the user and tells you what they can do in your app. It does not share credentials or create an account on your side.

Best practices

• Handle an empty partner_roles array. A user can have access to your product before a role is assigned. Show a clear message rather than an error.
• Supply role mappings when a practice installs your app. Mappings are stored per installation, so later changes to your app's default roles do not reach practices that have already installed it.
• Add a replacement role instead of renaming one. A rename removes the role from every user who had it.

For how roles are granted and resolved, see Roles & Access Context.

What to include here (TODO)

• Supported identity handoff patterns
• User provisioning expectations (create, link, deactivate)
• Security and auditing requirements