Sign in and roles

Prerequisites

• Operator Console reachable on port 18084
• A Keycloak user provisioned for your organisation
• Browser that can complete an OIDC/PKCE redirect

Sign in

1. Open the Operator Console (http://<host>:18084 unless your appliance publishes a different bind address).
2. Complete the Keycloak sign-in prompt (OIDC/PKCE).
3. Confirm you land on the console shell with the eight navigation pages visible.

Roles

Role	Read admin endpoints	Mutate (POST/PUT)
it_admin	Yes	Yes
app_owner	Yes	Yes
auditor	Yes	No — 403 RES-ADMIN-403

The auditor role is read-only. It can GET admin endpoints. Any mutation returns 403 with code RES-ADMIN-403.

Buttons can fail for auditors

The UI may still show action controls. If you are signed in as auditor, those actions are rejected server-side. This is expected fail-closed RBAC, not a console defect.

How to verify

1. Sign in as it_admin or app_owner.
2. Open API Access (or any mutating page) and confirm a read loads.
3. If you must validate auditor behaviour: sign in as auditor, attempt a mutation (for example creating an API key), and confirm the response is 403 / RES-ADMIN-403.

If it fails

Symptom	Likely cause	Action
Redirect loop / cannot complete login	Keycloak or OIDC client misconfiguration	Confirm Keycloak is up; contact Residion if the realm was Residion-provisioned
Console loads but actions return 403	Signed in as auditor, or role mapping missing	Use an it_admin / app_owner account, or request role correction
Console unreachable	Stack down or loopback bind	Check compose; use host-local access or SSH tunnel