Keycloak Admin Guide

Mon, 01 Jan 0001 00:00:00 +0000

This guide explains how to manage users, roles, and groups for GENIE.AI entirely through the Keycloak admin console. No GENIE.AI-specific interface is needed for user management.

Overview

GENIE.AI delegates all identity management to Keycloak. When an administrator creates, modifies, disables, or deletes a user in Keycloak, the changes take effect in GENIE.AI on the user’s next authentication. Roles assigned in Keycloak are reflected in the JWT claims and propagated to all GENIE.AI services.

External Idp Integration Guide

Mon, 01 Jan 0001 00:00:00 +0000

This guide explains how to connect an external identity provider (IdP) to GENIE.AI through Keycloak. Once configured, users can authenticate via the external IdP without any GENIE.AI code or configuration changes.

How It Works

GENIE.AI uses Keycloak as its sole identity boundary. When an external IdP is configured in Keycloak, the authentication flow is:

Browser -> GENIE.AI Frontend -> Keycloak Login Page
 |
 +-- [Local Credentials] -> Keycloak Token -> GENIE.AI
 |
 +-- [External IdP Button] -> External IdP Login
 |
 Keycloak Broker
 (issues own token)
 |
 Keycloak Token -> GENIE.AI

GENIE.AI always receives a standard Keycloak-issued OIDC token, regardless of which external IdP was used. The backend middleware, JIT provisioning, and frontend auth flow are completely unaware of the external IdP.

Configuration on GENIE.AI

Keycloak Admin Guide

Overview

External Idp Integration Guide

How It Works