Identity Provider

Users sign in through your own OIDC identity provider; the scanner backend validates JWTs as an OAuth2 resource server. Keycloak is the reference setup, but any standards-compliant OIDC provider works.

Backend settings

Variable	Default	Description
OIDC_ISSUER_URI	http://localhost:8082/realms/sensitive-data-scanner	Issuer URI. OIDC metadata is discovered from {issuer}/.well-known/openid-configuration; do not configure a JWKS URI manually.
OIDC_CLIENT_ID	sensitive-data-scanner-frontend	Public OIDC client the web UI authenticates as.
APP_SECURITY_ROLES_CLAIM	realm_access.roles	JWT claim path that contains the user's roles.
APP_SECURITY_ADMIN_ROLE	ADMIN	Role name that grants access to the administration pages.
APP_SECURITY_USER_ROLE	USER	Role name that grants ordinary access to the application.

Roles

The application distinguishes two roles:

• ADMIN - full access to every page and every action.
• USER - read-only access to the Risk Dashboard, the Findings list and finding detail, and the Suppressions history. A USER cannot review or classify a finding, cannot create or remove a suppression, and cannot start, pause, resume, or cancel a scan.

Every other page is ADMIN-only: Scans, Rule Catalog, Create Custom Rule, Audit Log, Jira Connection, License, Scan Configuration, Ruleset Transfer, and Reporting. The navigation hides what a USER cannot reach, and a request that is not authorized is rejected with HTTP 403.

A signed-in account holding neither role has no access at all: every endpoint answers HTTP 403 and the web UI shows a page saying so. Holding ADMIN is enough on its own -- it implies ordinary access, so an account does not need both roles.

Both role names are configurable, via APP_SECURITY_ADMIN_ROLE and APP_SECURITY_USER_ROLE, for providers whose role names differ.

Assign these as realm/client roles in your provider so they appear in the configured roles claim.

Keycloak example

1. Create a realm, for example sensitive-data-scanner.
2. Create a public client for the web UI, for example sensitive-data-scanner-frontend, with authorization code + PKCE and add your scanner origin to the valid redirect URIs, for example https://scanner.example.com/*.
3. Create realm roles ADMIN and USER and assign them to users. With Keycloak's default token mapping, realm roles appear in realm_access.roles, which matches the backend default.
4. Set OIDC_ISSUER_URI=https://<keycloak-host>/realms/sensitive-data-scanner on the scanner container. If you named the public client something other than sensitive-data-scanner-frontend, set OIDC_CLIENT_ID to that name as well.

The web UI does not carry these values compiled in: it reads them from the scanner's public GET /api/config endpoint when it starts, so the same image signs in against any provider.