The identity that starts a run should be the one your directory owns.
Keycloak is the identity provider NopsAI integrates with most deeply. Beyond standard OIDC login, it is the one provider with automatic entitlement synchronization: realm client roles become NopsAI team membership, so access follows the directory instead of drifting away from it.
Keycloak inside a governed run.
How Keycloak participates once it is connected — and what the platform does with what it returns.
Standard OIDC login
Issuer, authorization, token, JWKS and userinfo endpoints are configured explicitly, with a client ID and a credential reference for the secret. Users can be auto-created on first login and mapped by email domain.
Team role synchronization
With entitlement_sync mode keycloak_team_roles, NopsAI reads client roles from your realm through the admin API and reconciles them into team membership. This mode exists for Keycloak specifically and is not available for generic OIDC providers.
Membership drives authorization
Team membership is what approval steps check when they name teams, and what AAA evaluates for resource access. Syncing it means revoking a role in Keycloak revokes the ability to approve a production release.
Domain-scoped access
allowed_email_domains and domain_mapping restrict which identities may sign in at all and which tenant they land in, before any authorization question is asked.
The controls that make it safe to leave connected.
An integration is easy to add and hard to bound. These are the parts that decide whether it stays reviewable six months later.
Two credentials, both references
The client secret and the admin client secret are separate credential references. Role synchronization needs admin API access, and keeping that credential distinct means it can be rotated and audited on its own.
The effective subject is recorded
The identity resolved at login becomes the effective subject on the run record and on AI usage events, so evidence names a person from your directory rather than a service account.
Configuration lives in Git
The provider block is part of system configuration, reviewed and promoted like any other change. Adding an identity provider is a pull request.
Local login can stay available
local_enabled controls whether password login remains possible alongside SSO. Keeping a bounded local path is a deliberate choice for break-glass access rather than an oversight.
Owned by Git, reviewed like code.
Configuration is a reviewable file rather than a form someone filled in once. Credentials appear as references; the values live in the encrypted registry.
oidc:
enabled: true
auto_create_users: true
providers:
nopsai:
type: oidc
display_name: Enterprise SSO
issuer: https://sso.example.com/realms/nopsai
client_id: nopsai
client_credential_ref: credential://system/oidc/nopsai/client-secret
scopes: ["openid", "email", "profile"]
allowed_email_domains: ["example.com"]
entitlement_sync:
mode: keycloak_team_roles
admin_base_url: https://sso.example.com
realm: nopsai
admin_client_id: admin-cli
admin_client_credential_ref: credential://system/oidc/nopsai/admin-client-secret
target_resource_type: teamWorkflows where Keycloak shows up.
The same integration, seen from the workflow rather than from the connection.
Production incident at 2 a.m.
At 2 a.m. the hard part is finding what changed and deciding whether rollback is safe — fast, without losing the evidence trail.
Preparing a release
Scope mismatch, unmerged PRs, failed gates and an outdated runbook can all cause a late surprise.
A new employee onboards to a project
Docs go stale, active work is scattered, and every new hire rebuilds the same mental model on their own.
What teams ask about Keycloak.
What does keycloak_team_roles actually sync?
Client roles from the configured realm are read through the Keycloak admin API and reconciled into NopsAI team membership. It is the only entitlement synchronization mode implemented, which is why Keycloak has deeper integration than a generic OIDC provider.
Do I need the admin credential?
Only for role synchronization. Plain OIDC login works with just the client ID and client secret; the admin client credential is required because reading realm roles is an admin API operation.
What happens when someone loses a role?
Reconciliation removes the corresponding team membership. Because approval steps name teams, that person can no longer approve the gates that team owns — without anyone editing a pipeline.
Map your Keycloak workflow end to end.
Bring one real workflow. We will map its trigger, tools, approvals, runtime boundary and evidence requirements with you.