Skip to content
Chukfi CMS

Security & RBAC

Chukfi CMS is built with production-grade security from day one. It supports passwordless authentication, mandatory multi-factor authentication (MFA), and granular role-based access control (RBAC).

Section titled “Passwordless Magic Links”

No passwords to leak, hash, or manage. Users enter their email address, and Chukfi sends a secure, short-lived cryptographic magic link to their inbox.

Multi-Factor Authentication (MFA)

Section titled “Multi-Factor Authentication (MFA)”

Mandatory TOTP-based multi-factor authentication can be enforced globally or per-role. Users scan a QR code with any standard authenticator app (Google Authenticator, 1Password, etc.) during their first login.

Role-Based Access Control (RBAC)

Section titled “Role-Based Access Control (RBAC)”

Chukfi uses a colon-delimited permission model (resource:action) to enforce granular access. Built-in roles include:

  • Administrator — Full access to schemas, content, media, and settings.
  • Publisher — Can create, edit, and publish content. Cannot modify schemas.
  • Editor — Can create and edit drafts. Cannot publish or delete content.

Enterprise SSO: Microsoft Entra ID

Section titled “Enterprise SSO: Microsoft Entra ID”

For enterprise teams, Chukfi integrates natively with Microsoft Entra ID (formerly Azure AD) via OpenID Connect (OIDC). Map Entra ID groups directly to Chukfi roles to automate user provisioning.