Sirius A product of
Documentation Contact

How-to

Connect an identity provider

People sign in with a local account or your IdP. Services use sk_ tokens. The same RBAC applies to the console, the REST API, and the agent.

Add a primary OIDC provider

  1. Open Access → Identity providers.
  2. Create a provider with kind=oidc and mark it primary. Primary takes precedence over boot-time SIRIUS_AUTH_OIDC_* environment variables.
  3. Set issuer, audiences, and (optionally) a JWKS URL. If JWKS is omitted, Sirius discovers it from the issuer’s /.well-known/openid-configuration.
  4. Map claims if your IdP does not use the defaults: subject, tenant, roles, permissions, scope.
  5. Test. The test checks configuration without opening a user session.
  6. Save. Providers hot-reload — no process restart.
curl -s -X POST "$SIRIUS/identity/providers" -H 'content-type: application/json' -d '{
  "id": "corp-oidc",
  "kind": "oidc",
  "primary": true,
  "issuer": "https://idp.example.org",
  "audiences": ["sirius"],
  "default_tenant": "default"
}'

curl -s -X POST "$SIRIUS/identity/providers/corp-oidc/test"
curl -s "$SIRIUS/identity/providers/corp-oidc/plan"

Tokens must be signed (none is always rejected), carry a valid exp, and match issuer and audience. JWKS is cached (default 5 minutes) and fail-closed if the provider is down and no key is cached.

Brokered directory and SAML providers use the same /identity/providers surface with a different kind. Test and plan before you cut over.

Users, groups, and roles

Creating a user is metadata. It confers no access until you grant roles.

  1. Create the user (POST /users).
  2. Grant roles (/role-grants) or add the user to a group that already has roles.
  3. For SSO, map IdP group-claim values to Sirius groups so federated subjects inherit roles without a persisted membership.

Seeded roles cover admin, operator, viewer, auditor, and support. Custom roles are built from GET /permissions.

Effective permissions are the union of direct grants, group roles, and JIT claim mappings. Check them before you tell someone they are “in.”

Break-glass

Keep an emergency key for when the IdP is unreachable. Store it hashed via PUT /identity/break-glass. Rotate with POST /identity/break-glass/rotate. Use is audited. Prefer an expiry. An expired console key falls through to the deployment-configured env key rather than shadowing it.

Tenancy

Every resource is tenant-scoped. Cross-tenant access looks like 404, not 403. Production should refuse to start if isolation is off.

Next: Issue an API token and Security.