Skip to content
GERCIA Engineering

ADR-002: Sovereign OpenIddict IAM & 1:N Federated UserLogins

Status

Section titled “Status”

ACCEPTED (2026-08-30)

Context

Section titled “Context”

Authenticating diverse audiences (Internal Staff via Google Workspace, B2B Clients via Email/Password or Enterprise SSO, Mobile Patients via Google/Apple Social Login, and Hardware Stations via Station Tokens) created potential fragmentation across third-party identity providers (such as Firebase Auth or Auth0). Storing provider-specific columns (GoogleId, FirebaseUid) in core.users violated extensibility principles.

Decision

Section titled “Decision”
  1. Adopt OpenIddict running natively in Gercia.Api as the sovereign central Security Token Service (STS).
  2. Eliminate Firebase Auth in favor of direct C# native social token validation (Google.Apis.Auth / Apple OIDC) emitting GERCIA OpenIddict JWTs with Refresh Token Rotation.
  3. Establish the core.user_logins entity in a 1-to-N relationship with core.users, allowing users to link multiple social accounts (Google, Apple, Microsoft, GovBr) seamlessly.

Consequences

Section titled “Consequences”
  • Positive: Zero third-party identity vendor lock-in or per-active-user licensing costs.
  • Positive: Full data sovereignty and LGPD compliance within the Percona PostgreSQL database on EVEO servers.
  • Positive: core.users remains lean and extensible without provider-specific schema changes.