---
title: Sign-in and identity
description: How sign-in works in OpenLM Platform, the settings it depends on, and how to diagnose sign-in problems.
product: OpenLM Platform
---

## How sign-in works

OpenLM Platform has its own sign-in service, **identity**, at `https://<DOMAIN>/identity`. It's an OpenID Connect provider: it signs users in, then issues the tokens the UIs send with every request. A request goes through these steps:

```text
 1. User opens https://DOMAIN/licenses
 2. The UI sends the user to   https://DOMAIN/identity   (sign-in page)
 3. Identity checks the user's password (or your directory) and issues a token
 4. The UI calls                https://DOMAIN/api/...    with the token
 5. The gateway passes the call to a service
 6. The service asks identity:  is this token valid?   → https://DOMAIN/identity
 7. Valid: the service answers. Not valid: 401.
```

Because of step 6, the OpenLM Platform address must work [from inside the cluster](https://www.openlm.com/documentation/cloud/deployment-operations/on-premise/deployment-guide/kubernetes/concepts/networking#reaching-the-platform-address-from-inside-the-cluster) with a [trusted certificate](https://www.openlm.com/documentation/cloud/deployment-operations/on-premise/deployment-guide/kubernetes/concepts/tls-certificates).

## The settings it depends on

Every token names its issuer, and every service compares that name with its own setting. The values file sets them all from your `DOMAIN` ([step 4](https://www.openlm.com/documentation/cloud/deployment-operations/on-premise/deployment-guide/kubernetes/install/step-4-values)):

| Setting | Value |
|---|---|
| `AUTHORITY_URL`, `INFRASTRUCTURE__AUTHORITYURL` | `https://DOMAIN/identity` |
| `IssuerUri`, `UI_OAUTH_ISSUER_URL`, `UI_BASE_HREF_URL` | `https://DOMAIN/identity` |
| `INFRASTRUCTURE__USESECURITY` | `true` |
| `OLM__K8s__ServiceNamespace` | `openlm` |

Follow these rules for the settings:

- **Exactly the same text everywhere**: `https://openlm.example.com/identity` and `https://openlm.example.com/identity/` are different issuers to a service.
- **Always `https://`**: The browser is redirected to HTTPS, so a token issued under `http://` never matches.
- **Changing `DOMAIN` later**: Change these settings, then restart the identity service first and every other service after it.

## First start

On its first start, identity creates its database tables and registers the platform's applications. That takes a few minutes. Services that start before identity is ready don't fail: they wait and retry. But a service that started while identity was **unreachable** might fall back to a mode where it doesn't check security at all. Check 3 in [step 7](https://www.openlm.com/documentation/cloud/deployment-operations/on-premise/deployment-guide/kubernetes/install/step-7-verify) catches that (`404` instead of `401`). Restart the services once identity is healthy.

## Signing in with your directory

Identity can also sign users in against your Active Directory or LDAP, through the OpenLM Platform directory synchronization service (DSS). You set that up in the OpenLM Platform administration screens after the installation, not in Helm.

## Diagnose sign-in problems

Find the symptom in the following table:

| Symptom | Likely cause | Check |
|---|---|---|
| Sign-in page doesn't load (`/identity` gives 404/502/503) | Identity isn't running | `kubectl -n openlm get pods \| grep identity`, then its logs |
| Sign-in works, then every screen says it can't load data | Services can't reach or don't trust `https://DOMAIN/identity` | Logs of any backend: `IdentityUnavailable`, `SSL`, `certificate` |
| Endless redirect between UI and sign-in page | Issuer settings differ from the address in the browser, or `http://` somewhere | Compare the table in [The settings it depends on](#the-settings-it-depends-on) with the browser's address bar |
| `401` for a newly signed-in user | Clocks out of sync, or the services cached an old configuration | Check node time (NTP), then restart the services |
| `404` on `/api/licensemanager/bff/user` instead of `401` | Services started without security (identity was down) | Restart the services |

Start with the identity service's own log:

```bash
kubectl -n openlm logs deploy/openlm-identity --since=30m | grep -iE "error|exception|issuer" | tail -20
```