EQTY LabDocs

Authentication

Identity provider options for a Guardian Platform deployment

View as Markdown

The Guardian Platform requires an OpenID Connect (OIDC) compatible identity provider for user sign-in. Authorization comes from platform roles in Auth Service, not from the identity provider.

Supported Authentication Providers

The Guardian Platform supports the following identity providers:

  • Auth0 — Okta-owned identity platform with comprehensive OIDC support
  • Microsoft Entra ID (formerly Azure AD) — Microsoft’s enterprise identity platform
  • Keycloak — Open-source identity and access management

Choosing a Provider

Select an authentication provider based on your organization’s requirements:

  • Auth0: Best for organizations seeking a managed identity platform with minimal infrastructure overhead
  • Microsoft Entra ID: Ideal for enterprises already using Microsoft 365 or Azure services
  • Keycloak: Suitable for organizations requiring self-hosted, open-source identity management

The platform will automatically integrate with your chosen provider using the OIDC standard.

Okta

There is no Okta provider mode. The okta value is reserved but not implemented, and selecting it fails at startup. Auth Service can validate Okta tokens through generic OIDC (generic), but Guardian signs in only through Auth0, Keycloak, or Microsoft Entra, and the Helm chart does not configure generic OIDC, so a full deployment cannot use Okta yet.