PaletteAI authenticates users through Dex, which can broker authentication to an external OpenID Connect (OIDC) provider. This page shows how to configure Dex to use Keycloak as its OIDC provider so that PaletteAI users sign in with their Keycloak credentials.
The Kubernetes API server can trust an OIDC provider to authenticate users. We recommend that you work with your Kubernetes administrator and security team when you configure this integration. The exact steps vary by infrastructure provider and Kubernetes platform, such as AWS EKS, Azure AKS, or Google GKE.
PaletteAI supports Kubernetes User Impersonation. User impersonation is a feature that allows a user to impersonate another user. This is useful for scenarios where you are unable to configure the Kubernetes API server to trust the Dex as an OpenID Connect (OIDC) provider. Through the user impersonation feature, you can continue to use your existing OIDC provider or local Dex users, the key part is to ensure that proper group mappings are configured so that the user has the correct permissions to access the resources they need.
PaletteAI authenticates users through Dex, which brokers authentication to external identity providers through connectors. Connectors are defined in the PaletteAI Helm values under dex.config.connectors. This page explains how to add, update, and remove connectors on a running PaletteAI installation, how to apply the change, and what happens to users who are signed in when the change takes effect.