Admin: Authentication

Overview

This topic provides configuration information for RPI authentication.

Interaction API

Configure authentication at the Interaction API container using the Helm chart.

Native RPI authentication

When interactionapi.enableRPIAuthentication is set to true in the Helm chart (default), RPI authentication persists user details and encrypted credentials in the Pulse operational database.

The following settings are available to configure native authentication:

• To turn on/off native authentication

  • interactionapi.enableRPIAuthentication: true or false

• The URL used by the client application to connect to the Interaction API service must be provided

  • Authentication__RPIAuthentication__AuthorizationHost= https://interactionapi.com

• In a typical deployment, the internal address used by the containers to reach the InteractionAPI will differ from the public address used by the client application. In this case, this should be configured using the following setting:

  • Authentication__RPIAuthentication__AuthMetaHttpHost=http://internaladdress.net

Password policy

There are a number of settings available to configure password policy, such as minimum password length and required character types set in the interactionapi.passwordPolicy section of the Helm chart. The list of settings, along with their defaults, is as follows:

interactionapi:
  passwordPolicy:
    requiredLength: 12
    requiredUniqueChars: 4
    requireDigit: true
    requireNonAlphanumeric: true
    requireLowercase: true
    requireUppercase: true

Account lockout

The following Helm chart settings control locking of a user’s account following a series of failed sign in attempts:

interactionapi:
  accountLockout:
    maxFailedAccessAttempts: 5
    lockoutTimeSpan: "00:05:00"

OpenID connect authentication

RPI supports the use of the KeyCloak and Okta OpenID connection (OIDC) providers to be used to authenticate users accessing RPI. To integrate an OIDC provider with your environment, update the settings in the values.yaml file.

Refer to OpenID connection (OIDC) configuration for details about configuring these settings.

Microsoft Entra ID

RPI supports Microsoft Entra ID to be used to authenticate users accessing RPI.

Refer to Microsoft Entra ID configuration for details about configuring these settings.

Realtime API authentication

In the realtimeapi section…

authentication:
    # Basic authentication settings
    basic:
      # Enable forms basic auth
      forms: true
      # Enable listener queue basic auth
      listenerQueue: true
      # Enable recommendations basic auth
      recommendations: true
      # Enable standard basic auth
      standard: false
    # OAuth authentication settings
    oauth:
      # Access token lifetime in seconds
      accessTokenLifetimeSeconds: 360
      # OAuth database name
      databaseName: RPIRealtimeCore
      # Refresh token lifetime in seconds
      refreshTokenLifetimeSeconds: 360
    # Authentication type for the Realtime API
    type: basic

Token authentication

The default authentication method for the Realtime API is an authentication token in the header of the call to the API endpoint. To enable this authentication, set realtimeapi.authentication.type to basic.

The token is configured with the setting

• RealtimeAPIConfiguration__AppSettings__RPIAuthToken

The token is then passed to the endpoint in the RPIAuthKey header.

In the authentication.basic section, authentication can be turned on for these endpoints using:

    basic:
      # Enable forms basic auth
      forms: true
      # Enable listener queue basic auth
      listenerQueue: true
      # Enable recommendations basic auth
      recommendations: true
      # Enable standard basic auth
      standard: false

OAuth authentication

The Realtime API can be configured to use OAuth instead of the header token authentication.

To configure RPI Realtime to use OAuth, first create the SQL Server or PostgreSQL database required by the OAuth implementation. The scripts to create the database can be downloaded from the Configuration Service.

Set up the connection string in application settings. For example:

"ConnectionStrings": {
    "DefaultConnection": "<ConnString>" 
}

The application service settings required to enable OAuth are as follows:

• To turn on OAuth authentication

  • Set realtimeapi.authentication.type to oauth

    oauth:
      # Access token lifetime in seconds
      accessTokenLifetimeSeconds: 360
      # OAuth database name
      databaseName: RPIRealtimeCore
      # Refresh token lifetime in seconds
      refreshTokenLifetimeSeconds: 360

• The URL used by the client application to connect to the Realtime API service must be provided

  • Authentication__ RootServiceURL=https://realtimeapi.com

• In a typical deployment, the internal address used by the containers to reach the RealtimeAPI will differ from the public address used by the client application. In this case, this should be configured using the following settings:

  • Authentication__HttpMetaRootServiceURL=http://internaladdress.net

  • Authentication__DisableHttpRedirect=true

To get an access token, use Realtime endpoint {{APIAddress}}/connect/token.

By default, the script will create an OAuth client with an ID of b2630e23-713c-415a-b742-cbeffa525537, which requires a grant type of password and which requires a client secret. It will also create a user called coreuser. The request to the endpoint would look as follows:

It is strongly recommended you create your own OAuth client by inserting a new row into the OpenIddictApplications table and deleting the existing client.

First generate a Client Secret Hash based on a new Client Secret using the Realtime Utility available from the Configuration Service’s Downloads page. Using a command prompt, run the Realtime utility with following arguments.

clientsecret <Client Secret>

Then insert the new client using the SQL below, replacing the <Client Secret Hash> with the hash from the Realtime utility.

INSERT INTO [dbo].[OpenIddictApplications] 
          ([Id] 
          ,[ClientId] 
          ,[ClientSecret] 
          ,[Type] 
          ,[DisplayName] 
          ,[Permissions] 
) 
    VALUES 
          (Cast(NEWID() as varchar(50)) 
          ,'MyClientId' 
          ,'<Client Secret Hash>' 
          ,'confidential' 
          ,'My Client' 
          ,'["gt:password","gt:refresh_token"]') 
GO 

If access tokens or refresh tokens need to be immediately revoked, the authorizations(s) and token(s) can be purged from the database tables OpenIddictAuthorizations and OpenIddictTokens.

Once OAuth has been configured, users can be created or removed, and permissions granted, using the Account API endpoints.

Deployment service API

The deployment service API can be secured using a third-party OpenID connect provider, and supports the Client Credentials authentication flow. To configure the service to use the OIDC provider, configure the following Helm chart settings with the correct OIDC provider values:

deploymentapi:
  authentication:
    enabled: true
    issuer: https://login.example.com/realms/rpi
    hostAddress: https://deployment.example.com
    audience: rpi-deploymentapi
    clientId: rpi-deploymentapi

Cloud identity authentication

Certain RPI functionality (e.g., secret managers, Azure and GCP plugins) can make use of cloud provider identity to authenticate with cloud services. This can be configured in the services’ Cloud Identity application settings.

Last updated: August 11, 2026