AiX SSO Integration Architecture

Overview

AiX supports enterprise Single Sign-On (SSO) through a dedicated identity integration layer based on Keycloak.

Keycloak acts as the AiX SSO bridge/gateway between AiX and the customer's enterprise identity infrastructure. This approach provides AiX with a consistent authentication interface while allowing different customer environments to use their existing identity providers and authentication technologies.

AiX integrates with Keycloak using standard authentication protocols such as OpenID Connect (OIDC). Keycloak manages the connection to the customer's identity provider using the appropriate supported protocol or federation mechanism.

This architecture separates AiX application authentication from customer-specific identity infrastructure and reduces the need for AiX to implement separate authentication logic for each identity platform.

SSO Integration Architecture

The following diagram illustrates the logical integration between AiX, the AiX Auth Service, Keycloak, and the customer's enterprise identity infrastructure.

The architecture consists of four primary logical components:

AiX Application – The application accessed by the user.
AiX Auth Service – Manages the AiX authentication flow, application sessions, user identity mapping, and application-level authorization.
Keycloak (AiX SSO Bridge/Gateway) – Provides the standardized identity integration layer between AiX and external enterprise identity providers.
Customer Identity Provider – The customer's existing enterprise identity infrastructure responsible for authenticating the user.

Depending on the customer environment, the identity provider may include technologies such as:

Microsoft Active Directory / LDAP
Microsoft Entra ID
SAML 2.0 identity providers
OpenID Connect (OIDC) identity providers
An existing customer-managed Keycloak environment
Other identity platforms supported through Keycloak

Authentication Flow

When a user accesses AiX using enterprise SSO, the authentication process follows a standardized flow:

The user accesses the AiX application.
AiX initiates authentication through the AiX Auth Service.
The AiX Auth Service redirects the authentication request to Keycloak.
Keycloak identifies the configured customer identity provider and redirects or delegates authentication accordingly.
The user authenticates using the customer's existing authentication mechanism.
The customer identity provider returns the authentication result to Keycloak.
Keycloak validates the identity and maps the required user attributes and claims.
Keycloak returns the authenticated identity to the AiX Auth Service.
The AiX Auth Service maps the authenticated identity to the corresponding AiX user and establishes the application session.
The user is granted access to AiX according to the roles and permissions configured within AiX.

Authentication and Authorization Separation

The AiX SSO architecture separates enterprise authentication from application authorization.

The customer's identity provider is responsible for authenticating the user and establishing the user's enterprise identity.

Keycloak provides the identity brokering and federation layer between the customer's identity environment and AiX. It normalizes the authentication process so that AiX can use a consistent integration regardless of the underlying enterprise identity provider.

The AiX Auth Service remains responsible for AiX-specific application access, including:

Mapping the authenticated identity to an AiX user
User account status
AiX roles and permissions
Module and application access
Application session management

This separation allows enterprise authentication policies to remain under the control of the customer's identity infrastructure while AiX maintains control over application-level authorization.

Keycloak as the AiX SSO Bridge/Gateway

Keycloak provides an abstraction layer between AiX and the customer's identity infrastructure.

Instead of implementing separate authentication integrations within AiX for each identity technology, AiX communicates through a standardized Keycloak integration.

For example:

AiX
 │
 ▼
AiX Auth Service
 │
 ▼
Keycloak
(AiX SSO Bridge/Gateway)
 │
 ├── Active Directory / LDAP
 ├── Microsoft Entra ID
 ├── SAML Identity Provider
 ├── OIDC Identity Provider
 └── Existing Customer Keycloak

If the customer's identity infrastructure changes in the future, the corresponding integration can generally be handled at the Keycloak layer without requiring the AiX application authentication architecture to be redesigned.

Deployment Models

The Keycloak integration layer supports different deployment models depending on the customer's existing infrastructure.

AiX-Provided Keycloak

Where the customer does not already operate a suitable Keycloak environment, a dedicated Keycloak instance can be deployed as part of the AiX SSO integration architecture.

The deployed Keycloak instance acts as the AiX SSO bridge between AiX and the customer's identity infrastructure.

Customer-Managed Keycloak

Where the customer already operates Keycloak, AiX may integrate with the customer's existing Keycloak environment, subject to the customer's architecture, security policies, and configuration requirements.

In this deployment model, an additional AiX-specific Keycloak instance may not be required.

Architecture Benefits

The AiX SSO bridge/gateway architecture provides:

Standards-based enterprise SSO integration
Separation between AiX and customer-specific identity infrastructure
Support for different enterprise identity technologies
Centralized identity federation and protocol handling
Reduced authentication-specific logic within AiX
Consistent authentication integration across customer environments
Flexibility to accommodate future identity infrastructure changes
Clear separation between enterprise authentication and AiX authorization

The architecture therefore allows AiX to maintain a consistent authentication model while integrating with the identity infrastructure and security policies already established within the customer's enterprise environment.