Authentication
User authentication for docuteam desk is managed via a Keycloak instance. The system supports several identity integration methods:
- Direct Management: Users are created and managed directly within the Keycloak instance.
- External Identity Providers (IdP): Integration with external providers using OpenID Connect (OIDC) or SAML 2.0 (e.g., Azure AD).
Authorization Architecture
Access control is implemented through a two-tier permission model: Keycloak-level roles (Identity Provider) and desk-level permissions (Application level). For cloud clients, the keycloak level needs to be configured by docuteam; for on premises installations it depends on the setup.
1. Keycloak level roles
Keycloak roles define the user's identity within the organization and serve as the foundation for application access.
| Role | Dashboard | Spaces creation | Space configuration | Submit | Review | Configure org endpoints |
|---|---|---|---|---|---|---|
super-admin | yes | yes | yes | yes | yes | yes |
[org_id]-admin | yes | yes | yes | yes | yes | yes |
[org_id]-user | yes | ? | ? | ? | ? | ? |
Note that [org_id]-user users must also be granted specific desk-level permissions to access application features.
super-admin grants full administrative privileges across all organizations on the server, while [org_id]-admin grants space admin rights within the specified organization.
2. desk-level permissions
desk-level permissions define the specific functional capabilities of a user within a space. Multiple roles can be assigned to a single user.
| Role | Dashboard | Spaces creation | Space configuration | Submit | Review | Configure org endpoints | Delete Drafts | See Submissions |
|---|---|---|---|---|---|---|---|---|
space admin | yes | yes | yes | yes | yes | all submissions | ||
space submitter | yes | yes | yes | own submissions | ||||
space reviewer | yes | yes | view all submissions | |||||
space anonymous submitter | yes | yes | yes | all submissions created using anonymous link |