Sign in and roles¶
Attest signs people in through your organization's OpenID Connect provider and reads their role from the token. Nothing about roles is managed inside Attest.
Create the client¶
In the identity provider, create one client for Attest.
| Setting | Value |
|---|---|
| Client ID | attest |
| Type | OpenID Connect, confidential, standard flow on, direct access grants off |
| Valid redirect URIs | https://<your attest host>/auth/sso/callback |
| Valid post logout redirect URIs | https://<your attest host>/login |
| Web origins | https://<your attest host> |
Attest always sends a PKCE challenge with S256. The provider can be set to require it.
Create the roles¶
Create four realm roles with exactly these names.
| Role | For |
|---|---|
attest-viewer |
Security posture and evidence, read only. Leadership and CISO personas. |
attest-engineer |
Own applications, gate findings, submit. |
attest-sca |
Review queue: claim, accept, reject, authorize. |
attest-admin |
Everything above plus instance settings. |
The default roles scope carries realm roles into the token; nothing else is needed. Client roles on the attest client with the same names also work.
Assign roles to people or groups in the provider. A person with no role can sign in and sees a page saying they have no role in Attest.
Group structure for engineers¶
An engineer sees the containers whose declared organization and application match their group claims. The group path in the provider follows /<organization>/<application>/<role>, matching the organization and container key in each cdso_config.yml.
Configure the service¶
Five values, set as environment variables or CI variables for the deployment.
KEYCLOAK_URL=https://<identity provider>/auth
KEYCLOAK_REALM=<realm>
KEYCLOAK_CLIENT_ID=attest
KEYCLOAK_CLIENT_SECRET=<from the client credentials tab>
KEYCLOAK_REDIRECT=https://<your attest host>/auth/sso/callback
All of URL, realm, client id, and client secret must be set to enable sign in. Optional: KEYCLOAK_CA_BUNDLE for a private certificate authority, and ATTEST_SESSION_HOURS for the hard cap on a console session.
Verify¶
Open the console signed out. You are sent to the sign in page. Sign in as a person with a role. The profile menu shows their name, their roles, and their GitLab connection state. Sign out ends the session in the provider as well.
CAC and enclaves¶
Attest never implements smart card authentication. In an enclave where the identity provider requires CAC, Attest inherits it with zero code difference: one credential moment at the provider, then the same console.