Security and governance
Sign-in and roles
Keycloak OIDC sign-in and platform roles.
Sign-in
Converge signs users in with OpenID Connect through Keycloak, using the authorization code flow with PKCE. You enter your username, then sign in with a passkey or password on the identity provider's page. Converge itself never sees your password.
The access token is kept in the browser tab's session storage, not in long-lived storage, and is refreshed while you work.
Roles
| Role | Typical use |
|---|---|
admin | Administers the platform, catalogs and policies |
operator | Runs day-to-day operations and data flows |
analyst | Builds ontology, pipelines, logic and apps; analyses data |
viewer | Reads objects, files and apps |
approver | Decides pending action approvals |
Roles decide which applications appear in the navigation. The server enforces every permission independently through its authorization policies, so a hidden button is never the only protection.
Service access
Automated clients use the OAuth 2.0 client credentials grant. See Authentication.