Skip to main content

Admin Frontend configuration

Configure ai-dial-admin-frontend through environment variables on its Next.js server. This reference covers release 0.22.5: the direct-to-Core setup and optional service connections. It is for platform engineers; for the screens these settings enable, see Capabilities.

The advanced Docker Compose sample demonstrates direct Core access with Admin Frontend 0.22.1. The frontend's README lists the same variables; where the README and the source differ, this page follows the source.

Core connection​

VariableDefaultDescription
DIAL_CORE_API_URL—Required for direct administration. Core's base URL, reachable from the Admin container, for example http://core:8080. Requests carry the signed-in user's token.
DIAL_ADMIN_API_URLUnsetOptional Admin Backend base URL. Leave it unset, rather than setting an empty value, when no Admin Backend is deployed. See Optional Admin Backend.

Core must expose the Configuration API. Configure Core's identity providers to validate tokens from the same identity provider that signs users into Admin.

Authentication and administrator access​

Sign-in is on when NEXTAUTH_URL is set. The frontend then signs users in through the configured identity providers and forwards each user's token to Core and the optional services.

Core decides who is an administrator. Every Configuration API call needs a token that matches Core's access.admin.rules; other callers get 403. The frontend's ADMIN_ROLE_NAMES and DIAL_ROLES_FIELD don't restrict access in 0.22.5: the frontend records the result in the session, and no screen reads it. Any user who can sign in through the identity-provider client reaches the interface, so limit sign-in in the identity provider when that matters.

To give a user administrator access:

  1. Assign an administrator role to the user in the identity provider and include it in the token sent to Core, for example "roles": ["admin"].
  2. Configure Core's static access.admin.rules to match the same token claim. Creating a dynamic Core role named admin does not assign it to a user.

When Admin Backend is deployed, its FULL_ADMIN and READ_ONLY_ADMIN roles also apply; see Optional Admin Backend. Without Admin Backend, or with sign-in off, the interface treats every user as a full administrator, and Core and each service still authorize every call.

VariableDefaultDescription
NEXTAUTH_URL—Public Admin URL, used for authentication callbacks. Setting it turns sign-in on. Register <NEXTAUTH_URL>/api/auth/callback/<PROVIDER_ID> as the redirect URI in the identity-provider client; provider IDs are listed in Other identity providers.
NEXTAUTH_SECRET—Required session secret. Generate a secret, for example with openssl rand -base64 32, and inject it through your deployment's secret store.
NEXTAUTH_COOKIE_PREFIX—Prefix for session cookies. Use admin to avoid collisions with other applications on the same host.
AUTH_IDTOKEN_PROVIDERS—Comma-separated provider IDs, such as google,gitlab, whose ID token is forwarded instead of the access token. Configure Core to validate the selected token.
ADMIN_ROLE_NAMESadminComma-separated administrator role names. Recorded in the session; doesn't restrict access in 0.22.5.
DIAL_ROLES_FIELDdial_rolesPath to the roles claim for ADMIN_ROLE_NAMES, including dotted paths such as realm_access.roles.
AUTH_<PROVIDER_ID>_ADMIN_ROLE_NAMES, AUTH_<PROVIDER_ID>_DIAL_ROLES_FIELDThe global valuesPer-provider overrides, for example AUTH_KEYCLOAK_ADMIN_ROLE_NAMES. See Other identity providers for how the name is built.
SHOW_TOKEN_SUBfalseSet true to log the token subject instead of ****** when a token refresh fails.
NEXTAUTH_DEBUG—Any non-empty value turns on NextAuth debug logs.

With NEXTAUTH_URL unset, sign-in is off and the frontend sends requests without an Authorization header, so Core and each service must accept requests without a token. Use it only for local testing.

Keycloak example​

On Admin Frontend:

AUTH_KEYCLOAK_HOST=https://<KEYCLOAK_HOST>/realms/dial
AUTH_KEYCLOAK_CLIENT_ID=dial-admin-console
AUTH_KEYCLOAK_SECRET=<CLIENT_SECRET>
AUTH_KEYCLOAK_DIAL_ROLES_FIELD=roles
AUTH_KEYCLOAK_ADMIN_ROLE_NAMES=ConfigAdmin,admin

Configure the Keycloak client's role mapper to emit the assigned roles in the top-level roles claim. The sample's dial-admin user receives admin through the dial-admin-console client roles. For a nested claim, set Core's rule source to the claim path.

In Core's static settings.json, merge this access block with your existing settings:

{
  "access": {
    "admin": {
      "rules": [
        {
          "function": "CONTAIN",
          "source": "roles",
          "targets": ["ConfigAdmin", "admin"]
        }
      ]
    }
  }
}

Core's built-in default already matches admin in roles; use an explicit rule when allowing a different role such as ConfigAdmin. Keep Core's JWT validation enabled and configure its issuer, audience where applicable, and JWKS URL. See Access for rule semantics, including the different consequences of an empty rules array, and Identity providers for token validation. Static settings require a Core restart.

Other identity providers​

A provider is turned on when all of its required variables are set. The frontend has its own variables; DIAL Chat's authentication configuration doesn't apply to it.

ProviderProvider IDRequired variablesDefault scope
KeycloakkeycloakAUTH_KEYCLOAK_CLIENT_ID, AUTH_KEYCLOAK_SECRET, AUTH_KEYCLOAK_HOSTopenid email profile offline_access
Microsoft Entra IDazure-adAUTH_AZURE_AD_CLIENT_ID, AUTH_AZURE_AD_SECRET, AUTH_AZURE_AD_TENANT_IDopenid profile user.Read email offline_access
Auth0auth0AUTH_AUTH0_CLIENT_ID, AUTH_AUTH0_SECRET, AUTH_AUTH0_HOST; optional AUTH_AUTH0_AUDIENCEopenid email profile offline_access
GitLabgitlabAUTH_GITLAB_CLIENT_ID, AUTH_GITLAB_SECRET; optional AUTH_GITLAB_HOSTread_user
GooglegoogleAUTH_GOOGLE_CLIENT_ID, AUTH_GOOGLE_SECRETopenid email profile offline_access
Ping Identityping-idAUTH_PING_ID_CLIENT_ID, AUTH_PING_ID_SECRET, AUTH_PING_ID_HOSToffline_access
Amazon CognitocognitoAUTH_COGNITO_CLIENT_ID, AUTH_COGNITO_SECRET, AUTH_COGNITO_HOSTopenid email profile
OktaoktaAUTH_OKTA_CLIENT_ID, AUTH_OKTA_CLIENT_SECRET, AUTH_OKTA_ISSUERopenid email profile

<PREFIX>_SCOPE, where the prefix is the one in the table such as AUTH_AZURE_AD, replaces the default scope. <PREFIX>_NAME sets the sign-in button label, SSO by default; Okta has no _NAME variable.

The per-provider role overrides are named from the provider ID in upper case, not from the prefix. For Entra ID and Ping Identity, the IDs contain a hyphen, so the overrides are AUTH_AZURE-AD_ADMIN_ROLE_NAMES and AUTH_PING-ID_ADMIN_ROLE_NAMES; the AUTH_AZURE_ADMIN_ROLE_NAMES and AUTH_PING_ID_ADMIN_ROLE_NAMES names in the README are not read. If your platform can't set a name with a hyphen, use the global ADMIN_ROLE_NAMES and DIAL_ROLES_FIELD.

Optional services​

Set URLs that the Admin server can reach. Each backend needs its own deployment, storage, credentials, and identity-provider configuration. These variables only connect the frontend to it.

Deployment Manager and MCP containers​

VariableDefaultDescription
DEPLOYMENTS_ENABLEDfalseEnable the Deployments section.
DIAL_DEPLOYMENTS_API_URL—Deployment Manager Backend base URL. Required when deployments are enabled.
HF_ENABLEDfalseOffer the Hugging Face option in Model Servings. Requires deployments.
NIM_ENABLEDfalseOffer the NIM option in Model Servings. Requires deployments. Model Servings is hidden when both HF_ENABLED and NIM_ENABLED are off.
MCP_REGISTRY_ENABLEDfalsePreview. Enable creating MCP containers from the MCP Registry. Requires deployments.
DEPLOYMENTS_DISABLE_JSON_EDITORfalseDisable the JSON editor in deployment screens.
DEPLOYMENTS_RESOURCES_DEFAULTSSee belowJSON object with default CPU, memory, and GPU requests and limits.

The documented resource defaults are:

{"CPU_REQUEST":"0.5","CPU_LIMIT":"0.5","MEMORY_REQUEST":"1024","MEMORY_LIMIT":"1024","GPU_REQUEST":"1","GPU_LIMIT":"1"}

MCP container management uses DIAL_DEPLOYMENTS_API_URL, alongside the other container types. MCP_REGISTRY_ENABLED adds registry discovery; it is not needed for deploying an MCP server from an image or source repository. Backend cluster, database, authentication, and stdio proxy settings are in DIAL Deployment Manager configuration. For the screens, see Deployments and MCP containers.

Evaluation​

VariableDefaultDescription
DIAL_EVAL_API_URLUnsetPreview. Evaluation Framework Backend base URL, without /api/v1. Setting it enables Evaluation; leave it unset when no backend is deployed.

The frontend sends the signed-in user's token to the framework backend, which validates it with its own identity-provider settings and calls DIAL Core with it. Keep sign-in on: without NEXTAUTH_URL, the frontend sends no token, and the backend accepts requests only with authentication turned off. The backend's connections to Core, its databases, and Evaluation Metrics belong to the backend; see Connect DIAL Admin. See Evaluation for the workflow.

Analytics​

Deploy DIAL Analytics for the data-access API and DIAL Analytics Enrichment Runner for enrichment execution and runtime controls. Review the runner's version-specific control API before connecting an older Admin release.

VariableDefaultDescription
ANALYTICS_ENABLEDfalsePreview. Enable the Analytics section. Requires the data-access service URL.
DIAL_ANALYTICS_API_URL—Analytics data-access service base URL.
ANALYTICS_USAGE_ENABLEDfalseShow Analytics Dashboards at /dashboards. Requires ANALYTICS_ENABLED.
ANALYTICS_SESSIONS_ENABLEDfalseShow Sessions. Requires ANALYTICS_ENABLED.
DIAL_ANALYTICS_RUNNER_API_URL—Optional enrichment runner URL for pipeline runtime controls. Pause and resume depend on the runner version; see Pipeline controls.
DIAL_QUERY_ASSISTANT_DEPLOYMENT—Core deployment ID of the Queries AI assistant, such as applications/<BUCKET>/<APP>__<VERSION>. When unset, the AI view is hidden. Requests use DIAL_CORE_API_URL.
ANALYTICS_PUBLIC_URL—Public data-access URL shown in connection snippets.
ANALYTICS_FLIGHT_SQL_PUBLIC_URL—Public Flight SQL URL shown in connection snippets.

The advanced sample runs DIAL Analytics and the Enrichment Runner and sets ANALYTICS_ENABLED, ANALYTICS_USAGE_ENABLED, and ANALYTICS_SESSIONS_ENABLED to true, with DIAL_ANALYTICS_API_URL=http://analytics:5000 and DIAL_ANALYTICS_RUNNER_API_URL=http://analytics-enrichment-runner:5000. See Analytics for the data model and screens.

Optional Admin Backend​

Set DIAL_ADMIN_API_URL only when using Admin Backend. It supplies the Entities, Builders, and Access Management groups; the Audit group, with the telemetry Dashboards, Activity Audit, and Usage Log; backend-managed configuration transfers; and the FULL_ADMIN and READ_ONLY_ADMIN account roles. Its database and configuration export settings are documented in Admin Backend configuration.

Without it, Core administration still works. Backend-dependent screens are hidden; the sample also explicitly sets DISABLE_MENU_ITEMS=entities builders accessmanagement audit. Whole-configuration transfers through Admin Backend are unavailable. Deployments and Analytics transfers can still be offered when those services are enabled; see Import/export workflows.

VariableDefaultDescription
ENABLE_EXPORT_CONFIG_MAPfalseOffer configuration export from the Core config source in the backend export flow. Does not enable configuration export without the backend.

Appearance and navigation​

VariableDefaultDescription
APP_NAMEAI Dial AdminDisplayed application name.
THEMES_CONFIG_URL—Base URL of the themes service for palettes and icons.
DIAL_LINK—Home-page link to DIAL Chat.
DIAL_LINK_BUTTON_NAME—Label of the Open DIAL Chat button.
DIAL_ADMIN_DOCUMENTATION—Link to the administrator user guide.
GRAFANA_LINK—Link to Grafana.
DISABLE_MENU_ITEMS—Space-separated, case-insensitive menu keys to hide, for example entities builders accessmanagement audit. A key is the last part of a menu entry's key, such as models or platformmodels; the menu documentation lists them. catalog hides the Core-direct items: Models, Translators, Routes, App Runners, and Catalog Schemas in AI Gateway, and Roles, Keys, and Interceptors in Governance. Menu keys changed in 0.22; see release notes.
PUBLICATION_FILTERStitle,role,dial_rolesComma-separated attributes offered in publication access rules. The README lists title,role; the source default also has dial_roles.
CODE_APP_EDITOR_URL—Code App editor URL. An application whose endpoint and editorUrl both equal it is shown as a Code App.

Import limits​

VariableDefaultDescription
ZIP_IMPORT_MAX_ENTRIES500Maximum entries in an uploaded ZIP.
ZIP_IMPORT_MAX_ENTRY_SIZE_MB100Maximum expanded size of one ZIP entry, in MB.
ZIP_IMPORT_MAX_TOTAL_SIZE_MB1024Maximum total expanded ZIP size, in MB.

Note

The README also lists ALLOWED_IFRAME_ORIGINS and ALLOWED_IMAGE_ORIGINS. They have no effect in 0.22.5: the Content-Security-Policy header that would use them is commented out, and every page outside /api/v1/ is served with X-Frame-Options: DENY, so no site can embed DIAL Admin in a frame.

OpenTelemetry​

Admin Frontend uses the OpenTelemetry Node.js SDK. It instruments server HTTP requests and outgoing calls, and exports traces and logs over OTLP HTTP/JSON. Metrics use Prometheus by default.

VariableDefaultDescription
OTEL_SERVICE_NAMEdial-adminService name in telemetry.
OTEL_METRICS_EXPORTERPrometheusSet exactly otlp to push metrics through the OTLP HTTP exporter. Otherwise exposes :9464/metrics.
OTEL_EXPORTER_OTLP_ENDPOINTSDK defaultCollector HTTP endpoint, for example http://otel-collector:4318.
OTEL_EXPORTER_OTLP_PROTOCOL—Leave unset or set http/json. The frontend constructs the OTLP HTTP/JSON exporters itself; the grpc and http/protobuf values listed in the README aren't available.
OTEL_LOG_LEVEL—Set debug for internal telemetry diagnostics.

For platform-wide collector and scrape setup, see Tracing and Metrics. Admin's runtime telemetry is independent of the optional Analytics screens.

Docker Compose example​

Adapted from the advanced sample. This fragment assumes Core, Keycloak, and Themes already run on the same Compose network. The Keycloak issuer must be reachable by both the browser and the Admin container; Core must validate the same issuer.

services:
  admin-frontend:
    image: epam/ai-dial-admin-frontend:0.22.1
    ports:
      - "127.0.0.1:8056:3000"
    environment:
      DIAL_CORE_API_URL: http://core:8080
      NEXTAUTH_URL: http://localhost:8056
      NEXTAUTH_SECRET: ${NEXTAUTH_SECRET:?Set a session secret}
      NEXTAUTH_COOKIE_PREFIX: admin
      AUTH_KEYCLOAK_HOST: ${KEYCLOAK_ISSUER_URL:?Set the shared Keycloak issuer URL}
      AUTH_KEYCLOAK_CLIENT_ID: dial-admin-console
      AUTH_KEYCLOAK_SECRET: ${AUTH_KEYCLOAK_SECRET:?Set the client secret}
      AUTH_KEYCLOAK_DIAL_ROLES_FIELD: roles
      AUTH_KEYCLOAK_ADMIN_ROLE_NAMES: ConfigAdmin,admin
      THEMES_CONFIG_URL: http://themes:8080
      DISABLE_MENU_ITEMS: entities builders accessmanagement audit

DIAL_ADMIN_API_URL is deliberately absent. This example pins the sample's image; choose a compatible patched release for your deployment. Add DIAL_EVAL_API_URL, deployment settings, or analytics settings only when connecting those services. The evaluation services have their own Docker Compose example.

Further reading​