Device Management

Device Management in cidaas enables organizations to establish identity assurance across physical hardware, web browsers, and mobile devices. It connects hardware fingerprints to authenticated sessions, empowering users and administrators to monitor active logins and selectively terminate compromised or abandoned sessions (Device-Bound Logout).

Session Security cidaas 4.x Zero Trust Device-Bound Logout

1. Device Registration

Generate a persistent device identifier (dr) from browser or client telemetry before initiating authentication.

2. Active Session Audit

Retrieve all registered devices and active sessions linked to the signed-in user's profile.

3. Device-Bound Logout

Selectively revoke session tokens and unlink a target device without terminating sessions on other devices.

---

How It Works

1

Fingerprint & Register

Client telemetry or browser fingerprint is submitted. cidaas returns a unique Device Reference ID (dr).

2

Login & Bind

During authorization, the device reference is bound to the authenticated user's account and session context.

3

Inspect Sessions

The user views active laptops, mobile phones, or smart TVs in their Self-Service Profile portal.

4

Targeted Revocation

The user logs out of a lost or public device. Tokens bound to that device are instantly invalidated.

---

Core Perspectives

1. Multi-Factor & Hardware Possession (MFA / FIDO2)

Modern authentication flows rely on device-bound credentials such as FIDO2 / WebAuthn Passkeys, TouchID, FaceID, or Push authenticators. Registering and recognizing the underlying device allows cidaas to:

• Verify whether the physical authenticator matches the enrolled device.
• Offer seamless, passwordless login on recognized hardware.
• Give users control over retiring old phones or laptops when upgrading hardware.

2. Session Governance & Device-Bound Logout

Users frequently access enterprise systems across static workstations, personal laptops, mobile phones, and shared meeting-room screens.

• Rather than invalidating all credentials with a global session purge, Device-Bound Logout allows users to selectively revoke access on a single device directly from their account profile.
• Background tokens, refresh tokens, and active browser cookies issued specifically to that device are terminated immediately.

---

Developer Integration Guide

Step 1: Register Device Information

Before initiating an OAuth2 authorization flow, submit client telemetry to resolve or generate the device reference (dr).

curl -X POST "https://{your-domain}.cidaas.de/device-srv/deviceinfo" \
  -H "Content-Type: application/json" \
  -d '{
    "fingerprint": "a4b7f8e12c9d3e5f",
    "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)..."
  }'

Response (201 Created or 200 OK):

{
  "success": true,
  "status": 201,
  "data": {
    "dr": "c596b617-640a-4a57-8fb2-09418659d4c2"
  }
}

API Reference: POST /device-srv/deviceinfo or alias POST /device-srv/devices.

---

Step 2: List User Devices

To render the active devices list in a custom profile UI or portal, call the device maps endpoint using the authenticated user's access token.

curl -X GET "https://{your-domain}.cidaas.de/device-srv/devicemaps/user" \
  -H "Authorization: Bearer <USER_ACCESS_TOKEN>"

Response (200 OK):

{
  "success": true,
  "status": 200,
  "data": [
    {
      "deviceId": "c596b617-640a-4a57-8fb2-09418659d4c2",
      "deviceName": "Chrome on macOS",
      "sub": "user_12345",
      "createdTime": "2026-10-15T08:30:00Z",
      "updatedTime": "2026-10-22T06:00:00Z"
    }
  ]
}

API Reference: GET /device-srv/devicemaps/user. Requires a valid user access token.

---

Step 3: Trigger Device-Bound Logout

When the user clicks Logout next to a specific device in their account settings:

curl -X DELETE "https://{your-domain}.cidaas.de/device-srv/devicemaps/c596b617-640a-4a57-8fb2-09418659d4c2" \
  -H "Authorization: Bearer <USER_ACCESS_TOKEN>"

Response (200 OK):

{
  "success": true,
  "status": 200,
  "data": true
}

API Reference: DELETE /device-srv/devicemaps/{deviceId}.

---

API Summary

Operation	Method	Path	Required Auth	Purpose
Create Device Info	POST	/device-srv/deviceinfo	Public / None	Register browser/app telemetry and receive device reference ID (dr)
Get Device by ID	GET	/device-srv/devices/{deviceId}	Scope: cidaas:devices_read	Fetch detailed device hardware metadata (admin / audit)
Get Devices by User	GET	/device-srv/devicemaps/user	User Token	List all active devices and sessions belonging to the signed-in user
Logout User from Device	DELETE	/device-srv/devicemaps/{deviceId}	User Token	Terminate session and unlink device for the current user

info

Need Support?

Please contact us directly on our support page or reach out to cidaas support at [email protected].