Identity Provider Login for Internal Services

The Core Platform Portal uses the independently deployed core-platform-auth Keycloak service for human sign-in, tenant selection, session refresh, and logout. The Portal accepts a fixed set of supported tenant identities and maps each one to an isolated internal Portal tenant. These mappings are part of the product rather than runtime instance configuration. Unknown or mismatched tenant identities fail closed.

Portal operators configure the UI with the canonical Portal URL, shared Auth.js secret, Keycloak issuer, and core-platform client ID. The UI uses the fixed /auth Auth.js base path. The API is configured with the matching issuer, realm, audience, and authorized client. Runtime and Control Agent credentials remain separate from human authentication; connected agents also send the immutable internal Portal tenant ID supplied by their generated installation command.

Internal services such as:

Grafana
Platform Docs

Are exposed with Identity Provider login, currently only Google Gsuite is supported.

Configuring the domain for internal services

In your environment configuration


internal_services:
  name: secure
  domain: "gcp-dev-internal.cecg.platform.cecg.io"

The domain must be different from your ingress_domains.

DNS delegation for that domain should be configured as in DNS