Skip to main content

User management in Keycloak

Last update:

The ML platform uses Keycloak for authorization in internal applications and user management.

Keycloak implements an SSO (Single Sign-On) mechanism: after successful authorization in one application, you are automatically logged in to the others, so you do not need to enter your username and password again.

Login credentials for the ML platform

When ordering an ML platform, a user with the username Admin is created in the CMLP realm. A realm is an area for managing users, credentials, roles, and groups.

The Admin user belongs to the Security Administrator group — they have access to the Security Admin Console and can create users, set a password for them, and configure roles and groups.

To log in to the Security Admin Console, use the one-time password provided after ordering the ML platform. The password must be changed when logging in to the platform for the first time.

Create a user

  1. Open the ML platform at https://<ml_platform_domain>;.

    Specify <ml_platform_domain> — a URL of the form http://yourdomain.mlops.selcloud.ru that was issued after connecting the ML platform.

  2. Specify the security administrator login and password.

  3. Open the Security Admin Console application.

  4. Go to the Manage → Users.

  5. Click Add user.

  6. In the Username field, enter the user name.

  7. In the Email field, enter the email address; it is required for access to certain applications, such as Grafana.

  8. Optional: add the user to a group. If no group is specified, they will be added to the Viewer group by default.

    Keycloak has several user groups:

    • Security Administrator — has access to the Security Admin Console and can create users, configure user groups, and manage access. By default, the Admin user is created in the ML platform;
    • Administrator — can configure internal services (e.g., Grafana);
    • Editor — can change individual parameters (e.g., dashboards in Grafana, pipelines in ClearML);
    • Viewer — read-only access.

  9. Click Save.

  10. Optional: set a password for the user.

Set a password for a user

You can set a password for created users.

  1. Open the ML platform at https://<ml_platform_domain>;.

    Specify <ml_platform_domain> — a URL of the form http://yourdomain.mlops.selcloud.ru that was issued after connecting the ML platform.

  2. Specify the security administrator login and password.

  3. Open the Security Admin Console application.

  4. Go to the Manage → Users.

  5. Click View all users.

  6. Open the user page → Credentials.

  7. In the Password field, enter the password.

  8. Optional: to configure the user to change their password on first login, enable the Temporary toggle.

  9. Click Set Password.