Platform DocsDeployIdentity Integration

Identity integration

As an enterprise platform, Loambase Foundry neither recommends nor requires creating yet another account/password system inside the platform. The platform ships with a powerful identity federation mechanism that connects seamlessly to your existing identity provider (IdP).

1. Bundled unified identity center

The platform ships with Keycloak as its identity provider (IdP) by default. This means:

  1. SSO out of the box: the backend APIs, the frontend workspace, and runtime apps generated by App Builder all sign in through the same Keycloak instance.
  2. Standard protocol support: platform components issue and verify tokens with standard OAuth 2.0 and OpenID Connect (OIDC).

2. Connecting your existing identity system

To let employees sign in directly with their existing office accounts (domain accounts, DingTalk, WeCom, etc.), IT administrators configure identity brokering or user federation in the platform’s Keycloak admin console.

2.1 Via OIDC / SAML (recommended)

If your enterprise already runs a mature SSO portal (Auth0, Okta, Alibaba Cloud IDaaS, or a self-hosted OIDC server), this is the recommended integration path.

Steps:

  1. In your enterprise SSO portal, create a new client application and obtain the Client ID and Client Secret.
  2. Log in to Foundry’s Keycloak admin console and open Identity Providers.
  3. Choose OpenID Connect v1.0 or SAML v2.0.
  4. Fill in the credentials and the discovery URL obtained above.
  5. Once configured, a button like “Sign in with your enterprise portal” appears automatically on the Foundry login page. Employees click it, get redirected to the enterprise login page, and return with a token after successful authentication.

2.2 Via LDAP / Active Directory sync

If your enterprise manages the org structure with Windows AD or an LDAP server, you can configure directory sync instead.

Steps:

  1. Log in to Foundry’s Keycloak admin console and open User Federation.
  2. Add an LDAP provider.
  3. Configure the LDAP connection URL (e.g. ldaps://ldap.yourcompany.com:636), Bind DN and password.
  4. Configure user filters and attribute mapping (e.g. map the LDAP mail attribute to the platform’s email).
  5. Enable periodic full sync. Once synced, your org structure and employee list appear on the platform, and employees sign in to Foundry directly with their domain credentials.

3. Developer & machine-to-machine (M2M) auth

When automation scripts, CI/CD pipelines or agents need to call the Foundry platform APIs, they should not use personal accounts. The platform supports the standard client credentials grant.

Obtaining a service account token

Administrators can create a dedicated “service account” in the console and grant it specific API access permissions.

Developers use the generated credentials to obtain a token:

curl -X POST "https://auth.foundry.yourcompany.com/realms/foundry/protocol/openid-connect/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "client_id=your-service-account-id" \
  -d "client_secret=your-service-account-secret"

The API returns a short-lived JWT:

{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI...",
  "expires_in": 300,
  "token_type": "Bearer"
}

When calling the Foundry Backend API or SDK, simply carry the token in the request header:

Authorization: Bearer <access_token>
Environment & RequirementsSpec Overview