Skip to main content

Manage users and their access

This guide explains how user identity works in DIAL and how administrators grant, change, and remove a user's access. It is for administrators who govern who can use a DIAL deployment and what they can reach. It assumes you have access to DIAL Admin and to your organization's identity provider (IdP).

DIAL does not store user accounts​

DIAL has no user directory and no per-user create, edit, or delete screen. Identity is delegated to your identity provider over OpenID Connect. Each interactive user signs in through the IdP, and DIAL trusts the resulting JWT. Service-to-service callers authenticate with API keys instead.

Because of this, "managing a user" in DIAL means managing the roles their identity maps to, not editing an account record. The IdP owns the lifecycle of the account; DIAL owns what that account can do once it arrives. For the model behind this, see Authentication and access control.

How an identity becomes a set of permissions​

  1. A user authenticates with the IdP and receives a JWT containing claims, including group or role claims.
  2. DIAL Core maps those claims to one or more DIAL roles.
  3. The roles determine the models the user can use and the usage and cost limits that apply to them. Roles can also restrict applications, toolsets and routes; see Access to entities. Published applications and toolsets are further limited by the folder rules of their folder.

The claim-to-role mapping is configured per identity provider. See JWT configuration and your provider's guide under SSO / IdP setup.

Grant a user access​

  1. Confirm the user can sign in through the IdP and that their token carries the expected group or role claim. Group membership is managed in the IdP, not in DIAL.
  2. In DIAL Admin, open Governance > Roles and choose or create a role for that claim.
  3. On the role's Entities tab, add the models the user should use and set their token limits. To let the user reach applications, toolsets or routes, add the role to those entities in AI Gateway. For published applications and toolsets, the folder rules must also allow the user; see Folder Permissions.
  4. Confirm DIAL Core maps the user's claim to that role (see JWT configuration).

Result

When the user next signs in, their token resolves to the role, and they gain exactly the access the role grants.

Provision a service identity​

For automated callers and integrations, issue an API key instead of an interactive login:

  1. Open Governance > Keys and create a key for the integration's project.
  2. On the key's Roles tab, assign the roles the integration needs. A key must have at least one role.
  3. Copy the key value from the Key value dialog and deliver it to the integration owner through a secure channel. DIAL doesn't show the value again.

To replace a key's secret later, use Rotate on the key's configuration screen.

Grant or revoke administrator rights​

Administrators are not assigned in the panel. They are defined in DIAL Core's static settings, in the access.admin.rules block, which matches against token claims. To grant or revoke admin rights, edit that configuration — see Access Control settings. Read-only administrators are restricted through roles; see Read-only access.

Offboard a user​

Because DIAL trusts the IdP, removing a user's access starts there:

  1. Disable the account or remove the group claim in the IdP. The user can no longer obtain a valid token, and access stops at the next sign-in.
  2. Delete or rotate any API keys the user set up that should no longer be valid.
  3. Review the publication requests the user submitted in Approvals, and approve, decline or delete them as needed.

Further reading​