Skip to main content
User management in Keycloak
Last update:

User management in Keycloak

In the ML platform, authorization in back-end applications and user management uses Keycloak.

Keycloak implements SSO (Single-Sign On) mechanism: after successful authorization in one application, login to other applications is automatic — login and password do not need to be entered again.

Credentials for logging into the ML platform⁠

When ordering an ML platform, a user with the Admin login is created in the CMLP realm. A realm is an area for managing users, credentials, roles, and groups.

The Admin user belongs to the Security Administrator group — he/she has access to the Security Admin Console and can create users, password-protect and customize roles and groups.

Use a one-time password to log in to the Security Admin Console — it is provided after ordering the ML platform. The password must be changed the first time you log in to the platform.

Create a user⁠

  1. Open the ML platform at https://<ml_platform_domain>

    Specify <ml_platform_domain> — URL of the form http://yourdomain.mlops.selcloud.ruthat was issued after the ML platform was connected.

  2. Specify login and password security administrator.

  3. Open the Security Admin Console application.

  4. Go to the section Manage → Users.

  5. Click Add user.

  6. In the field Username enter a user name.

  7. In the field Email enter your e-mail address — it is required to access some applications, such as Grafana.

  8. Optional: add the user to a group. If you do not specify a group, it will be added to the Viewer group by default.

    Keycloak has several user groups:

    • Security Administrator — Has access to the Security Admin Console and can create users, configure user groups, and manage access. In the ML platform, a user is created by default Admin;
    • Administrator — can configure internal services (e.g. Grafana);
    • Editor — can change individual parameters (e.g. dashboards in Grafana, pipelines in ClearML);
    • Viewer — read-only access.

  9. Click Save.

  10. Optional: set a password for the user.

Set a password for the user⁠

You can set a password for the created users.

  1. Open the ML platform at https://<ml_platform_domain>

    Specify <ml_platform_domain> — URL of the form http://yourdomain.mlops.selcloud.ruthat was issued after the ML platform was connected.

  2. Specify login and password security administrator.

  3. Open the Security Admin Console application.

  4. Go to the section Manage → Users.

  5. Click View all users.

  6. Open the user page → tab Credentials.

  7. In the field Password enter the password.

  8. Optional: to set the user password to be changed at the first login, enable the toggle switch Temporary.

  9. Click Set Password.