Access & Authentication

Identity Model

BullSequana AI uses Keycloak as the platform access layer.

Its main purpose is to federate with your existing enterprise identity system, not to become the long-term source of identity for your organization.

In a production setup, users should normally authenticate through the identity provider your organization already uses, for example:

• Microsoft Entra ID
• another Keycloak instance
• LDAP or Active Directory
• another corporate identity provider integrated through standard federation flows

This means BullSequana AI can rely on your current identity model while still enforcing platform-level authentication, SSO, and access control.

What Users Experience

For most users, access works as follows:

1. open the BullSequana AI URL for your deployment
2. get redirected to the configured identity provider
3. authenticate with your existing enterprise account
4. return to the platform with the permissions granted to your user and groups

This gives users a single sign-on experience across the platform instead of separate accounts for each service.

Why Keycloak Is Used

Within BullSequana AI, Keycloak is used to:

• federate authentication with enterprise identity systems
• provide single sign-on across platform services
• manage application clients and login flows
• support role and group-based access patterns used by the platform

The important point is that Keycloak is typically the broker and control point for access, not the business system of record for user identities.

How Components Get SSO

You do not need to configure Keycloak clients manually for each platform service. The platform handles this automatically.

When a component is deployed and SSO is enabled for it, the deployment layer creates Argo CD hook jobs that:

1. register the component as an OIDC client in Keycloak (with the correct redirect URIs, scopes, and protocol mappers)
2. create any groups and roles the component needs
3. assign group-role mappings and service account permissions
4. clean up all of the above when the component is removed

This means every SSO-enabled component (such as Grafana, PgAdmin, MinIO, Langfuse, MLflow, Temporal, Superset, and the CoreAI services) gets a working login flow as soon as it is deployed, with no manual Keycloak administration required.

Controlling SSO per component

Each component has an sso_enable flag in the deployment configuration that defaults to true. Setting it to false deploys the component without Keycloak integration. This is useful for:

• air-gapped or restricted environments where Keycloak is not available
• development clusters where SSO is not yet configured
• specific components that should use an alternative authentication method

For details on how to set these flags, see the Configuration Model.

Two-Factor Authentication

If your deployment requires stronger access protection, Keycloak can also enforce two-factor authentication.

This adds a second login step beyond the password, usually through an authenticator application.

Typical benefits:

• stronger protection against password reuse or credential theft
• better alignment with enterprise security requirements
• safer access to platform services and administrative interfaces

Development And Demo Clusters

In development or demo clusters, federation may not be configured yet. In those cases, a user can be created directly in Keycloak for testing or evaluation purposes.

This is a convenience setup for non-production environments, not the target production access model.

Create a user manually in Keycloak

1. open the Keycloak admin console
2. switch to the dataplatform realm
3. go to Users
4. select Create user
5. fill in at least:
   • Username
   • Email
   • First name
   • Last name
6. create the user
7. open the user's Credentials tab
8. add a password for the account

After that, the user can log in with the credentials created for that environment.

Related Pages

• Platform Overview
• CoreAI Portal Guide
• Common Questions
• Keycloak Component
• Security Model
• Configuration Model -- SSO Scope