Sign-in and identity

How sign-in works

OpenLM Platform has its own sign-in service, identity, at https://<DOMAIN>/identity. It's an OpenID Connect provider: it signs users in, then issues the tokens the UIs send with every request. A request goes through these steps:

 1. User opens https://DOMAIN/licenses
 2. The UI sends the user to   https://DOMAIN/identity   (sign-in page)
 3. Identity checks the user's password (or your directory) and issues a token
 4. The UI calls                https://DOMAIN/api/...    with the token
 5. The gateway passes the call to a service
 6. The service asks identity:  is this token valid?   → https://DOMAIN/identity
 7. Valid: the service answers. Not valid: 401.

Because of step 6, the OpenLM Platform address must work from inside the cluster with a trusted certificate.

The settings it depends on

Every token names its issuer, and every service compares that name with its own setting. The values file sets them all from your DOMAIN (step 4):

Setting	Value
AUTHORITY_URL, INFRASTRUCTURE__AUTHORITYURL	https://DOMAIN/identity
IssuerUri, UI_OAUTH_ISSUER_URL, UI_BASE_HREF_URL	https://DOMAIN/identity
INFRASTRUCTURE__USESECURITY	true
OLM__K8s__ServiceNamespace	openlm

Follow these rules for the settings:

• Exactly the same text everywhere: https://openlm.example.com/identity and https://openlm.example.com/identity/ are different issuers to a service.
• Always https://: The browser is redirected to HTTPS, so a token issued under http:// never matches.
• Changing DOMAIN later: Change these settings, then restart the identity service first and every other service after it.

First start

On its first start, identity creates its database tables and registers the platform's applications. That takes a few minutes. Services that start before identity is ready don't fail: they wait and retry. But a service that started while identity was unreachable might fall back to a mode where it doesn't check security at all. Check 3 in step 7 catches that (404 instead of 401). Restart the services once identity is healthy.

Signing in with your directory

Identity can also sign users in against your Active Directory or LDAP, through the OpenLM Platform directory synchronization service (DSS). You set that up in the OpenLM Platform administration screens after the installation, not in Helm.

Diagnose sign-in problems

Find the symptom in the following table:

Symptom	Likely cause	Check
Sign-in page doesn't load (/identity gives 404/502/503)	Identity isn't running	kubectl -n openlm get pods | grep identity, then its logs
Sign-in works, then every screen says it can't load data	Services can't reach or don't trust https://DOMAIN/identity	Logs of any backend: IdentityUnavailable, SSL, certificate
Endless redirect between UI and sign-in page	Issuer settings differ from the address in the browser, or http:// somewhere	Compare the table in The settings it depends on with the browser's address bar
401 for a newly signed-in user	Clocks out of sync, or the services cached an old configuration	Check node time (NTP), then restart the services
404 on /api/licensemanager/bff/user instead of 401	Services started without security (identity was down)	Restart the services

Start with the identity service's own log:

kubectl -n openlm logs deploy/openlm-identity --since=30m | grep -iE "error|exception|issuer" | tail -20