Empower Admins for Client services

Existing implementation of RBAC has 2 identity providers per realm in Keycloak:

• Customer SSO named by enterprise name
• Empower internal SSO

Internal users are being processed by Empower internal SSO identity provider (IDP) that uses Hitachi Solutions Azure Active Directory to verify and provide user's identity. The IDP has mapper that assign users to Keycloak group based on their AD token. The Key on screenshots below stands for a claim name that is being inspected during token processing and Value - for Active Directory Group (Object) ID.

Find the group in Azure Portal by that ID from Value and add people or other groups. The next time they use customer's UI, they will trigger IDP mapper and the Admin role will be assigned.

📘 Default value

set to Empower-Dev-DeveloperTeam group

You can refer to technical documentation of the feature Deployment diagram, since it includes sequences and ERs for such case.