Skip to main content

Configure end-user authentication with JWT

This guide shows how to authenticate end users with JWT access tokens and grant them access to DIAL resources through token claims. Users log in through an identity provider (IdP), which issues a signed JWT that DIAL Core validates on each request. For server-to-server callers, use API keys instead.

Prerequisites​

  • A running DIAL Core instance with access to its static settings (settings.json) and dynamic configuration (config.json).
  • An identity provider connected to DIAL. If you have not set one up, follow SSO / IdP setup first.

Step 1: Validate tokens from your IdP​

DIAL Core needs to know how to verify incoming JWTs. Define your provider under identityProviders in settings.json — at minimum the JWKS endpoint and the claim that carries user roles.

{
  "identityProviders": {
    "myIdp": {
      "jwksUrl": "https://<YOUR_IDP_HOST>/.well-known/jwks.json",
      "rolePath": "roles"
    }
  }
}

rolePath points to the JWT claim DIAL reads to determine the user's roles. The per-provider values are listed in each IdP guide. For every attribute, see the Identity providers reference.

Step 2: Map a claim value to resources​

By default, an authenticated user can reach only public resources that are not role-restricted. To grant access to a specific deployment, add the relevant claim value to that deployment's userRoles array in config.json. The same pattern applies to applications, toolsets, and routes.

{
  "models": {
    "chat-gpt-35-turbo": {
      "userRoles": ["myRole"]
    }
  }
}

A user whose JWT contains myRole in the configured rolePath claim can now call chat-gpt-35-turbo. DIAL Core reloads config.json automatically; no restart is required.

Step 3: Grant administrator access (optional)​

To mark users as DIAL administrators, define a rule under access.admin.rules in settings.json that matches an admin claim. See the Access control reference for the rule syntax.

Result​

Users who log in through your IdP receive a JWT, and DIAL Core authorizes their requests based on the role claims in that token. Resource access and limits are driven entirely by the claim values you map.

Further reading​