Authentication and Authorization

Talisman leverages role-based access control (RBAC) to ensure secure and efficient management of integration services. Talisman uses Keycloak OIDC to handle authentication and authorization.

User Roles

We define three primary roles within the system to cater to different user needs and access levels:

Role	Access Level	Best Suited For
`platform-user`	View-only. Can monitor the health, performance, and metrics of integration services. Cannot modify configurations or deployment settings.	Stakeholders who need to stay informed about system status without directly managing services.
`platform-developer`	Operational control. Can create, modify, and delete integration services, manage deployment settings, and configure external integrations.	Developers and engineers responsible for building and maintaining integration services.
`platform-admin`	Full system control. Inherits developer permissions, with the added ability to handle user management, role assignments, and core system configurations.	Team leads and system administrators responsible for platform security and user management.

Keycloak Configuration

To set up Keycloak for Talisman, follow these steps:

1. Configure the Realm

Create a new Realm or select an existing one dedicated to Talisman users.

2. Create the Clients

You will need to create two separate clients—one for the frontend and one for the backend. Use the configurations outlined below:

Configuration Setting	Frontend Client	Backend Client
Client ID	`TALISMAN-FRONTEND`	`TALISMAN-BACKEND`
Client Authentication	Off	On
Authentication Flow	Standard, Direct access grants, Implicit	Standard, Direct access grants, Implicit
Root URL	`https://host`	`https://host`
Home URL	`https://host`	`https://host`
Valid Redirect URIs	`https://host/*`	`https://host/*`
Valid Post Logout Redirect URIs	`+`	`+`
Web Origins	`*`	`*`
Front Channel Logout	On	On
Backchannel Logout Session Req.	On	On

Important: For the TALISMAN-BACKEND client, you must generate a Client Secret. Once the client is created, navigate to the Credentials tab to generate and copy this secret.

3. Create Roles

Navigate to the Realm roles in Keycloak and create the following three roles to match the Talisman RBAC system:

platform-user
platform-developer
platform-admin