EQTY LabDocs

Identity Providers

The identity providers Auth Service supports, what the provider and Auth Service each own, and an operator checklist.

View as Markdown

Auth Service validates users through the identity provider configured for the deployment. Choose the provider before installation and keep Guardian, Auth Service, and deployment values aligned.

Supported Providers

ProviderNotes
KeycloakSupported for sign-in validation, role integration, token exchange, and Auth Service-issued refresh tokens.
Microsoft EntraSupported for sign-in validation, role integration, token exchange, and Auth Service-issued refresh tokens.
Auth0Supported for sign-in validation and provider-issued user tokens. An Auth0 post-login Action calls POST /api/v1/auth/claims-enrichment, authenticated with API_SECRET, to add platform claims and create the user’s DID key.
Generic OIDCSupported by Auth Service for OIDC-compatible providers. Guardian and the Helm chart do not support it yet.

The okta provider mode is reserved but not implemented — selecting it fails at startup. Auth Service can validate Okta tokens through Generic OIDC, but Guardian cannot sign in with it yet, so a full deployment cannot use Okta.

Provider Responsibilities

The identity provider owns user authentication. Auth Service owns platform membership, role checks, API keys, service accounts, and platform signing workflows.

Operator Checklist

  • Confirm issuer, audience, client, and callback settings match the deployed environment.
  • Confirm Guardian uses the same provider mode as Auth Service.
  • Confirm users are assigned to the correct organization and projects after sign-in.
  • Confirm token exchange is enabled only for Keycloak or Microsoft Entra deployments that need it.