%402x.svg)
No results.
Teller Government Cashiering signs users in with single sign-on (SSO) built on OpenID Connect (OIDC), with support for Microsoft Azure AD (Entra ID) and Active Directory Federation Services (ADFS). Staff log in through the agency's existing identity provider rather than a separate Teller password, so the identity provider stays the source of truth for who can access the system.
OpenID Connect is a widely adopted authentication standard that sits on top of OAuth 2.0. It lets an application confirm a user's identity by trusting an external identity provider instead of storing and checking passwords itself. When an application supports OIDC, users authenticate once against their organization's identity provider and receive a signed token that the application validates.
For a government cashiering platform, that matters because front-counter cashiers, clerks, and finance staff already have agency accounts. OIDC lets Teller reuse those accounts rather than creating a parallel set of credentials to manage.
The flow follows the standard OIDC pattern that most modern enterprise applications use:
Because Teller is browser-based and cloud-hosted, there is no desktop client to configure for each cashier. The sign-in happens through the browser against the identity provider the agency already trusts.
The identity provider decides who gets in. Teller trusts that decision and controls what each user can do once inside.
Yes. Teller supports OIDC authentication with SSO for both Microsoft Azure AD and ADFS. These are the two identity platforms most common across state, county, and municipal IT environments, which means most agencies can connect Teller to the identity provider they already run.
Azure AD (now branded Entra ID) is Microsoft's cloud-hosted identity service and is typical for agencies that have moved to Microsoft 365. ADFS is the on-premises federation service many governments still operate. Supporting both means Teller fits cloud-first agencies and those maintaining on-premises directories without forcing a change to the identity layer.
Teller is IT-light, and authentication is a big part of why that matters. When an application handles its own passwords, IT inherits a long list of ongoing tasks: provisioning accounts, resetting forgotten passwords, disabling access when someone leaves, and enforcing password complexity in a second place. SSO removes most of that from the application layer.
With OIDC-based SSO, several things stay centralized in the identity provider rather than duplicated in Teller:
That last point is often the one auditors care about most. Handling money at a government counter means access has to be tightly controlled and cleanly revoked. Tying Teller access to the central identity provider keeps that control in one place instead of asking finance or IT to track a separate cashiering user list.
SSO controls who signs in. It works alongside the other controls Teller applies once a user is inside the platform. Access to specific departments, drawers, and functions is governed by role-based permissions, so authenticating through Azure AD or ADFS does not by itself grant a user everything. It confirms identity, then Teller applies the appropriate permissions.
Teller runs as multi-tenant SaaS hosted on AWS, with encryption at rest and in transit and AWS KMS for key management. Authentication through a trusted identity provider is the front door to that environment. Because the token exchange happens over standard, encrypted web protocols, credentials are verified by the identity provider and never need to be stored inside the cashiering application.
Setting up OIDC SSO is a well-understood integration, but a few details are worth checking on the IT side before go-live:
These are decisions the agency's identity team typically already has answers for, which is why SSO tends to be a light lift rather than a project of its own. The result is a cashiering platform that staff reach with the same credentials they use everywhere else, and that IT governs from the identity provider they already run.
