Login/Role-based access control

Studio uses Keycloak - a third-party open-source tool to manage authentication, roles and permissions.

In Studio we have user roles that define what users can do in the system. These user roles are mapped to Keycloak groups. When a user logs in, they are assigned roles based on the group they are in.

Studio currently has 7 user groups: Lead annotator, Annotator, Flow builder, NLU editor, Business user, Developer, Conversation Analyst.

You can find the table of permissions per user group below.

How to set up users with Keycloak#

To set up a new user in Studio, follow these steps

1. Log in to Keycloak by navigating to https://host-name/auth

2. Select the Administration Console and use the admin credentials to log in. The credentials are the KEYCLOAK_ADMIN_USERNAME and KEYCLOAK_ADMIN_PASSWORD environment variables passed to the Helm chart

   

3. Change the realm to rasa-studio

   

4. In the left menu, navigate to Users

5. Click on Add user

   

6. Enter details for the new user

7. Assign appropriate permissions to the user by adding them to relevant groups

   

8. Click "Create" to confirm and create the user

9. Go to the "Credentials" section

   

10. Set the user's password. If you want the user to change the password on their first login, enable the "Temporary password" toggle

    

Change user password#

There are 2 ways to change a user password: user changes their password or admin changes their password

User changes their password on next login

1. Select the user in Keycloak

2. In ‘Credentials’, select ‘Reset password’

   

3. Enable the Temporary password so the user must change the password on the next login

4. Next time the user logs in, they will be asked to change their password

   

Admin changes user’s password

1. Select the user in Keycloak
2. Go to Credentials and select Reset password
3. Enter a new password and confirm

Manage users#

At any point, the admin can edit, or delete users or end users’ sessions

Delete users:

1. Go to User list

2. Locate the user you wish to remove.

3. Select the Delete option in the kebab menu

   

4. Confirm the deletion to remove the user from the system

   

Change username, names:

1. Select the user

2. Go to Details

3. Update the user info

   

Change user permissions:

1. Select the user

2. Go to Groups

3. Update the groups the user is belong to

   

Log user out of the current session:

1. Select the user

2. Go to Sessions

3. Locate the session associated with the user's current session.

4. In the kebab menu, select Sign out

   

How to configure email#

Keycloak sends emails to users to verify their email addresses, when they forget their passwords, or when an administrator needs to receive notifications about a server event. To enable Keycloak to send emails, you provide Keycloak with your SMTP server settings.

1. Choose your realm in the upper left corner (e.g. rasa-studio)

2. Click Realm setting

3. Click the Email tab

   

4. Fill in the fields and toggle the switches as needed. Please refer official Keycloak documentation for more details on each field.

Advanced login configuration#

Keycloak supports several Identity providers and SSO protocols. You can configure them in the Identity providers section for the realm. Please refer to the official Keycloak for more details on how to configure SSO protocols and set different Identity providers.