Skip to main content

Authentication

Overview​

This page describes how to set up authentication for Key UI (Workspace). For information about authenticating java/python/excel client using api key, see KeyAccess

By default Key UI (Workspace) uses WebDataServer for authentication. The section below describes the authentication strategies available in WebDataServer and how to set that

Admin User​

A local admin account with username=admin is created by default in WebDataServer. This account cannot be disabled or deleted.

Default password for username=admin is ksadmin

Please update this password by setting the property: KS_WEB_DATA_SERVER_ADMIN_PASSWORD in secrets.properties

Local Accounts​

Local accounts can be setup by supplying the property: KS_WEB_DATA_SERVER_LOCAL_ACCOUNTS

This takes a list of accounts with username, password and user roles e.g.

KS_WEB_DATA_SERVER_LOCAL_ACCOUNTS=[{       \
  "username": "test",                      \
  "password": "kstest",                    \
  "roles": ["DEVELOPER", "OTHER"]          \
}]

Note: local accounts are available for testing only and should be avoided in production.

LDAP, SAML​

WebDataServer can be setup to use LDAP or SAML for authentication.

Sample LDAP Configuration

KS_APP_WEB_DATA_SERVER_SECURITY=ldap

# LDAP server URL
KS_APP_WEB_DATA_SERVER_LDAP_URL=ldap://ldap.keysquare.trading:389/dc=keysquare,dc=trading

# LDAP user search filter pattern
KS_APP_WEB_DATA_SERVER_LDAP_USER_SEARCH_FILTER=(&(uid={0})(objectclass=person))

# LDAP user search base DN
KS_APP_WEB_DATA_SERVER_LDAP_USER_SEARCH_BASE=cn=users,cn=accounts

Sample SAML Configuration

KS_APP_WEB_DATA_SERVER_SECURITY=saml

# SAML IdP metadata URL or file path
KS_WEB_DATA_SERVER_SAML_IDP_METADATA=https://sso-provider/application/saml/appId/metadata/

# SAML SP signing certificate path
KS_WEB_DATA_SERVER_SAML_SP_SIGNING_CERTIFICATE=file:/certs/server.crt.pem

# SAML SP signing key path
KS_WEB_DATA_SERVER_SAML_SP_SIGNING_KEY=file:/certs/server.pem

# SAML registration ID
KS_WEB_DATA_SERVER_SAML_REGISTRATION_ID=keysquare

# SAML assertion consumer service URL
KS_WEB_DATA_SERVER_SAML_ACS_URL=https://my-app.com/api/web/login/saml2/sso/{registrationId}

# Base URI for SAML redirects
KS_WEB_DATA_SERVER_SAML_REDIRECT_BASE_URI=https://my-app.com

WebDataServer will need to be restarted for these settings to take effect

When a user successfully logs into Key UI using their sso id, a user entry will automatically be created for them in KeyAccess. An administrator can then assign roles to this user by adding it to a user group

Of course, you can create the user entry in KeyAccess ahead of time using the users ldap id in lowercase e.g. HELLO12 will be hello12

We don't currently support auto-assigning users to groups/roles using ldap group membership. Please reach out to us if you're interested in this feature