Authentication

Authentication in the console #

To access the Platform Orchestrator console, users authenticate through the Keycloak instance deployed with their installation.

If your identity provider email changes, your email will be updated in the Orchestrator as well on your next log in.

Identity providers #

Installation administrators manage local users and identity-provider connections in Keycloak. Keycloak can also broker external OpenID Connect and SAML identity providers.

Authentication in the CLI #

Once your installation administrator has created your user and organization, use the octl login command to authenticate the CLI against the configured API endpoint.

octl login

This obtains a short-lived authentication token which is written to the local config file.

Single Sign-On (SSO) #

Single Sign-On (SSO) allows users to authenticate using their organization’s existing identity provider (IdP). The self-hosted installation includes Keycloak, which supports brokering external OpenID Connect and SAML identity providers.

Configure SSO #

An installation administrator configures identity providers in the Keycloak administration console for the platform-orchestrator realm. Refer to the Keycloak identity brokering documentation  for the provider-specific setup.

Signing in #

Open your Platform Orchestrator console, select SSO Login, and enter your organization ID.

When signing in via SSO for the first time, a user is assigned with Viewer role automatically, but it can be changed by your organization’s Admins.