Skip to content

Authentication & Single Sign-On

Authentication controls how users verify their identity when accessing AiX.

AiX supports local authentication and enterprise Single Sign-On (SSO). When enterprise SSO is required, Keycloak is used as the SSO gateway between AiX and the organization's identity environment.

If the organization already operates a compatible Keycloak environment, AiX can connect to the organization's existing Keycloak deployment.

If Keycloak is not already available, an AiX SSO Gateway based on Keycloak can be deployed as part of the AiX solution.

This provides AiX with a consistent authentication interface while allowing organizations to continue using their existing enterprise identity infrastructure.

Authentication and Authorization

Authentication and authorization perform different functions.

Authentication determines:

Who is the user?

Authentication verifies the identity of the person accessing AiX.

Authorization determines:

What is the user allowed to do?

After authentication, AiX uses its own roles, permissions, teams, and resource access controls to determine which capabilities and information the user can access.

A simplified model is:

Enterprise Identity → Keycloak → AiX User → Roles & Permissions → AiX Resources

This separates enterprise authentication from application-level authorization.

Authentication Methods

AiX supports two primary authentication approaches.

Local Authentication

With local authentication, users authenticate using credentials managed within the AiX environment.

Local authentication may be used for standalone environments, development and testing, or environments where enterprise SSO is not required.

Enterprise Single Sign-On

When enterprise SSO is required, AiX uses Keycloak as its SSO gateway.

Keycloak provides the integration layer between AiX and the organization's enterprise identity environment.

A typical authentication architecture is:

User

↓

AiX

↓

Keycloak

↓

Enterprise Identity Environment

The underlying enterprise environment may use technologies such as Active Directory, LDAP, SAML, or Kerberos.

AiX therefore does not need to implement separate authentication mechanisms for each customer identity environment.

AiX SSO Gateway

The AiX SSO Gateway is based on Keycloak.

It provides a standardized authentication interface between AiX and enterprise identity systems.

AiX communicates with Keycloak using a standard authentication protocol, while Keycloak handles integration with the organization's underlying identity infrastructure.

For example:

AiX → Keycloak → Active Directory / LDAP

or:

AiX → Keycloak → SAML Identity Provider

or, where applicable:

AiX → Keycloak → Active Directory / Kerberos

This architecture isolates the AiX application from differences between customer identity environments.

Deployment Options

There are two standard approaches for integrating Keycloak with AiX.

AiX SSO Gateway

If the organization does not already operate Keycloak, a dedicated Keycloak instance can be deployed as the AiX SSO Gateway.

The architecture is:

AiX

↓

AiX SSO Gateway (Keycloak)

↓

Customer Identity Environment

The AiX SSO Gateway is then configured to integrate with the organization's existing identity infrastructure.

Customer Keycloak

If the organization already operates Keycloak, AiX can connect to the customer's existing Keycloak environment where permitted by the organization's architecture and security policies.

The architecture becomes:

AiX

↓

Customer Keycloak

↓

Customer Identity Environment

In this scenario, a separate AiX Keycloak deployment may not be required.

The customer's identity and security teams remain responsible for the operation and policies of their Keycloak environment.

Enterprise Identity Integration

Keycloak provides the bridge between AiX and supported enterprise identity technologies.

Depending on the customer environment, this may include:

Active Directory and LDAP

Keycloak can connect to supported LDAP directory services, including Microsoft Active Directory.

A typical architecture is:

AiX → Keycloak → Active Directory / LDAP

The enterprise directory remains the authoritative source for the user's enterprise identity.

SAML

Where the organization provides a SAML Identity Provider, Keycloak can broker authentication between the SAML environment and AiX.

A typical architecture is:

AiX → Keycloak → SAML Identity Provider

This allows AiX to maintain a consistent authentication interface regardless of the customer's SAML implementation.

Kerberos

In Active Directory environments where Kerberos authentication is required, Keycloak can provide the appropriate integration with the enterprise authentication environment.

A typical architecture may be:

AiX → Keycloak → Active Directory / Kerberos

Kerberos configuration depends on the customer's Active Directory, DNS, browser, network, and security environment.

Detailed technical configuration is covered under Integration → Identity & SSO.

Authentication Flow

A typical enterprise SSO login follows this process:

  1. The user accesses AiX.
  2. AiX redirects the user to Keycloak for authentication.
  3. Keycloak determines the appropriate enterprise authentication method.
  4. The user authenticates using the organization's identity environment.
  5. Keycloak validates the authenticated identity.
  6. Keycloak returns the authenticated identity to AiX.
  7. AiX associates the identity with the corresponding AiX user.
  8. AiX applies the user's roles, permissions, teams, and resource access.
  9. The user is granted access to the authorized AiX capabilities.

The user's enterprise password does not need to be managed by AiX.

Identity Mapping

After successful authentication, AiX associates the identity returned by Keycloak with an AiX user.

Identity information may include:

  • Unique user identifier
  • Username
  • Display name
  • Email address
  • Enterprise groups
  • Department
  • Other approved identity attributes

A stable and unique identity identifier should be used when associating an enterprise ide