Version: Latest

Login/Role-based access control

Studio uses Keycloak - a third-party open-source tool to manage authentication, roles and permissions.

In Studio we have user roles that define what users can do in the system. These user roles are mapped to Keycloak groups. When a user logs in, they are assigned roles based on the group they are in.

Studio currently has 7 user groups: Lead annotator, Annotator, Flow builder, NLU editor, Business user, Developer, Conversation Analyst.

You can find the table of permissions per user group below.

Groups πŸ‘‰ Roles πŸ‘‡AnnotatorLead annotatorFlow builderNLU editorBusiness userDeveloperConversation analyst
View assignmentsβœ…
Assign annotationβœ…
View batchesβœ…βœ…
Annotate batchesβœ…βœ…
View batches for reviewβœ…
Review batchesβœ…
View Annotation historyβœ…βœ…βœ…βœ…βœ…
Export annotationsβœ…βœ…
Add annotations to training dataβœ…βœ…
View access in CMSβœ…βœ…βœ…βœ…βœ…
Create new NLU in CMSβœ…βœ…βœ…βœ…
Create new NLU in Annotationβœ…βœ…βœ…
Create new NLU in Flow Builderβœ…βœ…βœ…
Edit existing NLU in Flow Builderβœ…βœ…βœ…
Edit existing NLU in CMSβœ…βœ…βœ…βœ…
View access to flow builderβœ…βœ…βœ…βœ…βœ…
Create new flowβœ…βœ…
Edit existing flowβœ…βœ…
Try assistantβœ…βœ…βœ…
Manage assistantsβœ…βœ…βœ…βœ…βœ…
View conversation viewβœ…
Manage conversation tags added to conversationsβœ…
Manage conversation tagsβœ…

How to set up users with Keycloak

To set up a new user in Studio, follow these steps

  1. Log in to Keycloak by navigating to https://host-name/auth

  2. Select the Administration Console and use the admin credentials to log in. The credentials are the KEYCLOAK_ADMIN_USERNAME and KEYCLOAK_ADMIN_PASSWORD environment variables passed to the Helm chart

  3. Change the realm to rasa-studio

  4. In the left menu, navigate to Users

  5. Click on Add user

  6. Enter details for the new user

  7. Assign appropriate permissions to the user by adding them to relevant groups

  8. Click "Create" to confirm and create the user

  9. Go to the "Credentials" section

  10. Set the user's password. If you want the user to change the password on their first login, enable the "Temporary password" toggle


Change user password

There are 2 ways to change a user password: user changes their password or admin changes their password

User changes their password on next login

  1. Select the user in Keycloak

  2. In β€˜Credentials’, select β€˜Reset password’

  3. Enable the Temporary password so the user must change the password on the next login

  4. Next time the user logs in, they will be asked to change their password


Admin changes user’s password

  1. Select the user in Keycloak
  2. Go to Credentials and select Reset passwordimage
  3. Enter a new password and confirm

Manage users

At any point, the admin can edit, or delete users or end users’ sessions

Delete users:


Please make sure to never modify the realmadmin user. This user is used by Studio to call Keycloak APIs and should not be deleted or modified.

  1. Go to User list

  2. Locate the user you wish to remove.

  3. Select the Delete option in the kebab menu

  4. Confirm the deletion to remove the user from the system


Change username, names:

  1. Select the user

  2. Go to Details

  3. Update the user info


Change user permissions:

  1. Select the user

  2. Go to Groups

  3. Update the groups the user is belong to


Log user out of the current session:

  1. Select the user

  2. Go to Sessions

  3. Locate the session associated with the user's current session.

  4. In the kebab menu, select Sign out


How to configure email

Keycloak sends emails to users to verify their email addresses, when they forget their passwords, or when an administrator needs to receive notifications about a server event. To enable Keycloak to send emails, you provide Keycloak with your SMTP server settings.

  1. Choose your realm in the upper left corner (e.g. rasa-studio)

  2. Click Realm setting

  3. Click the Email tab

  4. Fill in the fields and toggle the switches as needed. Please refer official Keycloak documentation for more details on each field.

Advanced login configuration

Keycloak supports several Identity providers and SSO protocols. You can configure them in the Identity providers section for the realm. Please refer to the official Keycloak for more details on how to configure SSO protocols and set different Identity providers.