Identity & Access

Enable or disable agent channels. This page also hosts an Identity wizard that is a connectivity pre-check only — it does not save IdP federation.

Console	Identity & Access → Agent channels
API	PUT /v1/admin/channels · (wizard test) POST /v1/admin/identity/test
Mutating?	Channels — yes

Prerequisites

• Mutating role (it_admin / app_owner) to change channels
• Understanding that SSO federation is not completed in this console today

Identity wizard does not persist federation

The wizard offers an identity-provider selector, an Issuer / metadata URL field, and Test IdP connection (POST /v1/admin/identity/test). There is no save/persist endpoint for identity federation. Actual federation must be created in Keycloak. Customer-facing SSO runbooks are coming soon and are blocked on Keycloak production hardening plus a scoped customer-admin role.

Enable or disable agent channels

1. Open Identity & Access.
2. Open Agent channels.
3. Enable or disable the channel you need.
4. Save (PUT /v1/admin/channels).

Verify

1. The channel toggle reflects the new state after save.
2. Exercise the related agent path (or confirm with Residion which external channel maps to the toggle).
3. As auditor, confirm a save attempt returns 403 RES-ADMIN-403.

Optional: Test IdP connection (pre-check only)

1. On Identity & Access, open the Identity wizard.
2. Select the IdP type and enter the Issuer / metadata URL.
3. Click Test IdP connection.
4. Treat a successful test as connectivity only — not as completed SSO setup.

Verify

• Test returns a clear success or failure for reachability/metadata.
• No expectation that the IdP is now federated for console login.

If it fails

Symptom	Action
403 on channel save	Use it_admin / app_owner
IdP test fails	Fix network / metadata URL; do not assume console can repair Keycloak config
Looking for “Save IdP”	Does not exist — see Identity & SSO and What still needs Residion