Overview

This document outlines the different aspects of the identity and access management system on the DynamoAI platform.

Deploying for the first time? Phase 5 of the Deployment Runbook sequences these guides and states which are required.

Understanding Access

This section addresses the following questions:

What are the different levels and patterns of access on Dynamo AI platform?
What is the different between organizational level and resource level access?
How can the different levels and patterns of access be used in Dynamo AI?

Roles

This section lists out the different roles with what actions each of these roles will allow you to perform on the platform, including the organizational and resource level roles.

User Management

The section covers the User Management in detail especially addressing the following questions

How can I see the list of users onboarded to the platform and what roles they have?
How can I add a new user?
How can I change the role of an existing user?

This section provides a comprehensive mapping of roles to associated scopes within the platform, detailing the specific actions users are permitted to perform based on their assigned roles. After going through this section you'll be able to address these questions:

What are the different actions available in the platform?
What scopes map to those actions?
How do these scopes map to user roles?

Keycloak SSO

This section describes the Single Sign-On (SSO) capabilities of Keycloak within the DynamoAI platform, allowing seamless user authentication. After going through this section, you'll be able to address these questions:

How does Keycloak SSO work with DynamoAI?
How can enterprises benefit from it?

Keycloak as IdP

This section explains how to configure Keycloak as an Identity Provider (IdP) for the DynamoAI platform, allowing users from your existing Keycloak to authenticate with DynamoAI's Keycloak instance. After going through this section, you'll be able to address these questions:

How do I configure my Keycloak as an IdP for DynamoAI?
What are the necessary steps to integrate Customer-Keycloak with DynamoAI-Keycloak?
How can users from Customer-Keycloak log in to DynamoAI?

Adding Mappers

This section explains how to map identity provider claims onto platform groups and roles, so that directory group membership grants access here. After going through this section, you will be able to address these questions:

How do I place every federated user in the all-users group?
How do I grant an org-level role from a directory security group?
What does the mapper Sync Mode setting change, and why does a mapper added later not reach existing users?
How do I confirm which roles a user actually received?

Default IdP Redirect

This section explains how to send users straight to your identity provider instead of presenting the Keycloak login form. After going through this section, you will be able to address these questions:

How do I skip the Keycloak login page for federated users?
How do I retain a route to local sign-in for break-glass access?

Entra ID as IdP

This section explains how to configure Microsoft Entra ID (Azure AD) as an Identity Provider (IdP) for the DynamoAI platform, allowing users from your Entra ID tenant to authenticate with DynamoAI's Keycloak instance. After going through this section, you'll be able to address these questions:

How do I register an application in Entra ID for DynamoAI?
What are the necessary steps to integrate Customer-Entra-ID with DynamoAI-Keycloak?
How can users from Entra ID log in to DynamoAI?

Keycloak Web Console via IdP

This section explains how to authenticate to the Keycloak Web Console through your enterprise IdP and disable the default local admin user to tighten security. After going through this section, you'll be able to address these questions:

How do I use my enterprise IdP to access the Keycloak Web Console?
Why should I use a separate IdP application for Keycloak Web Console access versus DynamoAI application login?
How do I restrict Keycloak Web Console access using Verify Essential Claim when my IdP provides a distinguishing claim?
How do I safely disable the default Keycloak admin user while retaining break-glass recovery?

Keycloak Web Console via Entra ID

This section provides Entra ID–specific instructions for Keycloak Web Console access, building on the general Keycloak Web Console via IdP guide and reusing Keycloak configuration steps from Entra ID as IdP. After going through this section, you'll be able to address these questions:

How do I register a separate Entra ID application for Keycloak Web Console access?
How do I configure Entra ID group or role claims for Keycloak Web Console authorization?
What differs from application-level Entra ID integration when configuring the master realm?

Storing OIDC Client Secrets via Vault

This section explains how to keep OIDC client secrets out of the Keycloak database by enabling Keycloak vault file mode and mounting secrets from an external store such as Azure Key Vault. After going through this section, you'll be able to address these questions:

How do I enable Keycloak vault file mode for DynamoAI-Keycloak?
How do I mount an OIDC client secret so Keycloak can read it at runtime?
How do I reference a vault-backed secret when creating an Identity Provider instead of storing the plaintext value in the database?

Entra ID Groups Claim Overage

This section explains why users in large Entra ID tenants may sign in successfully but not receive DynamoAI roles from claim-based mappers, and how to fix missing groups claims caused by Entra ID token limits. After going through this section, you'll be able to address these questions:

Why do Advanced Claim to Role mappers fail for some Entra ID users but not others?
How do I confirm whether the ID token is missing the groups claim?
How do I configure Entra ID to emit only the authorization groups DynamoAI needs?

Troubleshooting IdP Logins

This section maps common post-login symptoms for federated users to their causes and fixes — missing Policies tab, authorization policy errors, absent email claims, and missing claim-mapped roles. After going through this section, you'll be able to address these questions:

Why does an IdP user sign in but lack application access?
How do I activate an IdP user on the platform?
Where do I look when the error message points to permissions but roles look correct?

SMTP Integration

This section details the integration of an SMTP server with Keycloak to enable email functionalities such as password resets, using AWS SES as an example configuration. After going through this section, you'll be able to address these questions:

How do I configure SMTP settings in Keycloak?
What are the prerequisites for setting up SMTP with Keycloak?
How can I enable password reset functionality via email?