Identity & SSO

Coming soon

Customer-facing SSO runbooks are not published yet. One prerequisite has landed; one remains:

1. ✅ Keycloak production hardening — done. Keycloak now runs in production mode with Postgres persistence, brute-force lockout, and fail-closed admin credentials.
2. ⏳ A scoped customer-admin role in Keycloak — still needed; customers must not be handed full realm-admin. Runbooks stay unpublished until this lands.

What is true today

• Console authentication uses Keycloak SSO with browser OIDC/PKCE.
• Federation of Azure AD, Google Workspace, or Okta is a Keycloak task, not an Operator Console save flow.
• The Operator Console Identity wizard is a connectivity pre-check only (POST /v1/admin/identity/test). There is no persist endpoint for identity federation.

What will be documented when unblocked

Per-IdP Keycloak runbooks (Azure AD / Google Workspace / Okta) that end with: return to Operator Console → Identity & Access → Test IdP connection as verification.

Until then, coordinate identity federation with Residion. Related console behaviour for agent channels is documented under Identity & Access.