Skip to main content

Overview

This document outlines the different aspects of the Identity Mangemenet System on DynamoAI Platform

Understanding Access​

This section addresses the following questions:

  • What are the different levels and patterns of access on Dynamo AI platform?
  • What is the different between organizational level and resource level access?
  • How can the different levels and patterns of access be used in Dynamo AI?

Roles​

This section lists out the different roles with what actions each of these roles will allow you to perform on the platform, including the organizational and resource level roles.

User Management​

The section covers the User Management in detail especially addressing the following questions

  • How can I see the list of users onboarded to the platform and what roles they have?
  • How can I add a new user?
  • How can I change the role of an existing user?

Scopes In Detail​

This section provides a comprehensive mapping of roles to associated scopes within the platform, detailing the specific actions users are permitted to perform based on their assigned roles. After going through this section you'll be able to address these questions:

  • What are the different actions available in the platform?
  • What scopes map to those actions?
  • How do these scopes map to user roles?

Keycloak SSO​

This section describes the Single Sign-On (SSO) capabilities of Keycloak within the DynamoAI platform, allowing seamless user authentication. After going through this section, you'll be able to address these questions:

  • How does Keycloak SSO work with DynamoAI?
  • How can enterprises benefit from it?

Keycloak as IdP​

This section explains how to configure Keycloak as an Identity Provider (IdP) for the DynamoAI platform, allowing users from your existing Keycloak to authenticate with DynamoAI's Keycloak instance. After going through this section, you'll be able to address these questions:

  • How do I configure my Keycloak as an IdP for DynamoAI?
  • What are the necessary steps to integrate Customer-Keycloak with DynamoAI-Keycloak?
  • How can users from Customer-Keycloak log in to DynamoAI?

Entra ID as IdP​

This section explains how to configure Microsoft Entra ID (Azure AD) as an Identity Provider (IdP) for the DynamoAI platform, allowing users from your Entra ID tenant to authenticate with DynamoAI's Keycloak instance. After going through this section, you'll be able to address these questions:

  • How do I register an application in Entra ID for DynamoAI?
  • What are the necessary steps to integrate Customer-Entra-ID with DynamoAI-Keycloak?
  • How can users from Entra ID log in to DynamoAI?

Keycloak Web Console via IdP​

This section explains how to authenticate to the Keycloak Web Console through your enterprise IdP and disable the default local admin user to tighten security. After going through this section, you'll be able to address these questions:

  • How do I use my enterprise IdP to access the Keycloak Web Console?
  • Why should I use a separate IdP application for Keycloak Web Console access versus DynamoAI application login?
  • How do I restrict Keycloak Web Console access using Verify Essential Claim when my IdP provides a distinguishing claim?
  • How do I safely disable the default Keycloak admin user while retaining break-glass recovery?

Keycloak Web Console via Entra ID​

This section provides Entra ID–specific instructions for Keycloak Web Console access, building on the general Keycloak Web Console via IdP guide and reusing Keycloak configuration steps from Entra ID as IdP. After going through this section, you'll be able to address these questions:

  • How do I register a separate Entra ID application for Keycloak Web Console access?
  • How do I configure Entra ID group or role claims for Keycloak Web Console authorization?
  • What differs from application-level Entra ID integration when configuring the master realm?

Storing OIDC Client Secrets via Vault​

This section explains how to keep OIDC client secrets out of the Keycloak database by enabling Keycloak vault file mode and mounting secrets from an external store such as Azure Key Vault. After going through this section, you'll be able to address these questions:

  • How do I enable Keycloak vault file mode for DynamoAI-Keycloak?
  • How do I mount an OIDC client secret so Keycloak can read it at runtime?
  • How do I reference a vault-backed secret when creating an Identity Provider instead of storing the plaintext value in the database?

SMTP Integration​

This section details the integration of an SMTP server with Keycloak to enable email functionalities such as password resets, using AWS SES as an example configuration. After going through this section, you'll be able to address these questions:

  • How do I configure SMTP settings in Keycloak?
  • What are the prerequisites for setting up SMTP with Keycloak?
  • How can I enable password reset functionality via email?