Skip to content

Authentication and Access Management

Belt uses an external provider for user sign-in and role management. Keycloak is used by default, but it can be replaced with a corporate provider compatible with OpenID Connect (OIDC).

The provider must support the Authorization Code + PKCE flow, issue JWT Access Tokens, and expose public validation keys through JWKS. User accounts and passwords are stored by the provider, not in Belt.

Belt Roles

Before adding users, an administrator must create roles in the provider. Role names must be lowercase and included in the Access Token.

Role Permissions
viewer View connections, flows, chains, monitoring, and other available objects.
developer View, create, edit, and delete objects, and perform available operations.
deploy Run Deploy processes.

The developer role already includes view permission, so assigning both roles to a user is not required.

In the current version, roles apply to the entire Belt instance. Access control for individual workspaces is not currently available.

Initial Keycloak Configuration

The configuration is performed by a Keycloak administrator.

  1. Create a dedicated realm for Belt or select an existing corporate realm.
  2. Create an OIDC client for the Belt frontend.
  3. Enable Standard Flow and PKCE S256 for the client.
  4. Specify allowed redirect URLs and Web Origins for the address where Belt is available.
  5. Create the viewer, developer, and deploy roles.
  6. Make sure that assigned roles are included in the user's Access Token.
  7. Provide the Belt administrator with the provider connection settings: issuer URL, client ID, and required scopes.

The Belt frontend is a public client and must not store a Client Secret.

Creating a User

To add a user in Keycloak:

  1. Open the Users section in the selected realm and create a user.
  2. Specify a username, email address, first name, and last name.
  3. In the Credentials section, set a password. Disable Temporary if the user should not be required to change it at first sign-in.
  4. In Role mapping, assign one of the Belt roles.
  5. Give the user the Belt URL and their username.

Belt creates an internal user record automatically after the first successful sign-in. Creating a user separately in the Belt database is not required.

Signing In to Belt

  1. Open Belt in a browser.
  2. The application redirects you to the corporate provider or Keycloak sign-in page.
  3. Enter your credentials.
  4. After successful sign-in, you return to Belt and see the features permitted by your assigned role.

If a role is missing or is not included in the token, a user can authenticate with the provider but Belt will not grant access to protected features.

Closing the browser tab ends the Belt session. Refreshing the page usually does not require entering the password again while the provider session is active.

Connecting Another Provider

Instead of Keycloak, you can use a corporate identity provider if it supports:

  • OpenID Connect;
  • Authorization Code Flow with PKCE;
  • JWT Access Tokens;
  • public keys through JWKS;
  • role claims in the token.

In Belt, specify the provider issuer, OIDC client ID, scopes, and settings for reading roles from the token. Add the Belt URL to the provider's list of allowed Redirect URIs and Web Origins.

The process for creating a client, user, and roles depends on the selected provider.