Sign-in and providers

The admin UI’s sign-in page has one button per identity provider you add and a form for local accounts with e-mail and password. The weikio CLI and your pipelines sign in with API keys, and weikio login gets one through the hub’s approval page in the browser. The backend issues every token itself, signed with ES256 keys that it keeps sealed and rotates every 90 days, so no separate identity server is needed.

Add Microsoft Entra ID#

Register an application for Weik.io in your Entra tenant and keep its client secret as a project secret. Create a project for it that the installation never deletes, such as platform, then set the secret there. weikio secret set asks for the value with hidden input:

$ weikio project create platform
$ weikio secret set platform/entra-client-secret

Then add the provider. --display-name is the name on the sign-in button, so this provider gets the button Continue with Microsoft:

$ weikio provider set entra --kind entra --tenant <tenant-id> --client-id <id> --client-secret-ref platform.entra-client-secret --display-name Microsoft

The command prints the redirect URI to register at the provider, https://acme.example/api/v1/auth/callback/entra for a hub at acme.example. A tenant ID pins sign-in to that one tenant. To admit several tenants, give the tenant as organizations or common together with --allowed-tenant and the tenant IDs it admits, and only tokens of those tenants are accepted.

Sign-in uses OpenID Connect, and the hub calls no Microsoft Graph address: during a sign-in it reaches only the provider’s discovery document, keys and token addresses.

Add an OpenID Connect provider#

Any other OpenID Connect provider, such as Keycloak or a sovereign cloud’s sign-in, is a provider of kind oidc with its issuer address, and its client secret goes in the same project:

$ weikio secret set platform/keycloak-client-secret
$ weikio provider set keycloak --kind oidc --authority https://sso.acme.example/realms/acme --client-id weikio --client-secret-ref platform.keycloak-client-secret --display-name "Acme SSO"

weikio get providers lists the providers, and weikio describe provider entra shows one with its redirect URI and whether its client secret is found. Settings › Access › Providers shows the same in the admin UI.

Claim mappings#

A claim mapping turns a value the provider puts in its token into a grant, applied at every sign-in through that provider. An Entra provider’s mappings read the roles claim, the app roles, and the groups claim when a token has no roles. Another provider uses the groups claim unless --claim-path gives another claim.

$ weikio mapping add entra groups <group-id> --grant finance/deployer@production

A mapping without --integrations and --apis covers the whole project, and with either it covers exactly the integrations and APIs it names. --platform-admin makes the members of a group platform administrators. weikio get mappings lists the mappings with their IDs. weikio delete mapping <id> removes one. The grants it gave end within 15 minutes in every session whose provider gave a refresh token, and at the next sign-in in the other sessions.

A session signed in through a provider has the person’s local grant and the mapped grants together. API keys never get mapped grants, so a key has only what was granted to its owner directly with weikio member add.

Limit local accounts#

Once federated sign-in works, let local accounts sign in only for emergencies:

$ weikio settings set --local-accounts breakGlassOnly

From then on a password sign-in is accepted only from a break-glass account, and only while a break-glass window is open. Once you’ve added a provider, the Providers page suggests this setting for as long as local accounts are open to everyone.

While local accounts are on, a platform administrator creates them with weikio user create, which prints a one-time set-password link valid for 72 hours, and issues a new link with weikio user reset-password. A password is 12 to 1,024 characters. Passwords are stored as PBKDF2-SHA256 hashes with 600,000 iterations, sealed with the master key. Five wrong sign-in attempts for one account within 15 minutes lock it for 15 minutes, and the hub also limits sign-in attempts per address. Platform administrators and break-glass accounts give a code from an authenticator app at every local sign-in, as Two-factor sign-in says. A federated sign-in uses the provider’s own second factor.

The browser session#

The admin UI is served from the same address as the API, so its session cookie keeps the __Host- prefix, there’s no CORS and no cross-site cookie. The session is kept in the hub’s own storage, so whichever backend answers the next request knows it. Changing your password ends your other sessions.