AiX Authentication Support

Overview

AiX supports multiple authentication methods to accommodate different deployment environments, security requirements, and enterprise identity infrastructures.

Authentication is managed through the AiX Auth Service, which provides a consistent authentication and user management layer for the AiX platform.

AiX currently supports three primary authentication methods:

• Local Authentication – Username and password authentication managed directly by AiX.
• Azure OAuth2 Authentication – Authentication using Microsoft identity services through OAuth2 / OpenID Connect (OIDC).
• Enterprise Single Sign-On (SSO) – Enterprise identity integration through Keycloak, which acts as the AiX SSO Bridge/Gateway.

Regardless of the authentication method used, AiX maintains application-level user information, roles, permissions, and access controls.

Authentication Architecture

The following diagram illustrates the authentication methods supported by AiX and how they integrate through the AiX Auth Service.

Figure: AiX Authentication Support

The AiX Auth Service provides the common authentication layer between the AiX application and the configured authentication method.

This architecture allows the authentication mechanism to vary according to the deployment environment without requiring the AiX application itself to implement separate authentication flows for each identity platform.

Local Authentication

Local authentication provides direct username and password authentication using credentials managed by AiX.

The AiX Auth Service validates the supplied credentials against the AiX user database and establishes an application session when authentication is successful.

Local authentication can be used where an external identity provider is not available or where a deployment requires AiX-managed user authentication.

AiX remains responsible for the associated user account, account status, roles, permissions, and applicable authentication policies.

Azure OAuth2 Authentication

AiX supports authentication using the Microsoft identity platform through OAuth2 / OpenID Connect (OIDC).

With this authentication method, the user's identity is authenticated by Microsoft rather than through a locally managed AiX password.

The authentication result and associated identity information are returned to the AiX Auth Service, which maps the authenticated identity to the corresponding AiX user and establishes the AiX application session.

This approach allows organizations already using Microsoft identity services to use their existing enterprise identities and authentication policies when accessing AiX.

Enterprise Single Sign-On

For enterprise environments requiring integration with different or existing identity infrastructures, AiX supports Single Sign-On through Keycloak.

Keycloak acts as the AiX SSO Bridge/Gateway, providing an identity brokering and federation layer between AiX and the customer's enterprise identity infrastructure.

Depending on the customer environment, Keycloak can integrate with identity technologies such as:

• Microsoft Active Directory / LDAP
• Microsoft Entra ID
• SAML 2.0 identity providers
• OpenID Connect (OIDC) identity providers
• Existing customer-managed Keycloak environments
• Other identity providers supported through Keycloak

This architecture provides AiX with a standardized enterprise SSO integration while allowing the customer's existing identity infrastructure to remain responsible for user authentication.

For additional information about the enterprise SSO architecture, see AiX SSO Integration Architecture.

Authentication and Authorization

AiX separates authentication from application authorization.

Authentication determines and verifies the identity of the user. Depending on the configured authentication method, this may be performed by AiX, Microsoft identity services, or the customer's enterprise identity provider through Keycloak.

After authentication, the AiX Auth Service maps the authenticated identity to an AiX user.

AiX then applies application-level authorization, including:

• User account status
• Roles and permissions
• Module access
• Application access
• Other AiX-specific access controls

This separation allows organizations to retain control of their enterprise authentication policies while AiX independently manages application-level authorization.

Authentication Method Selection

The authentication method used for an AiX deployment depends on the customer's infrastructure and security requirements.

Authentication Method	Authentication Provider	Typical Use
Local Authentication	AiX	AiX-managed accounts or environments without an external identity provider
Azure OAuth2	Microsoft identity platform	Organizations using Microsoft identities and OAuth2 / OIDC
Enterprise SSO	Customer IdP through Keycloak	Enterprise environments requiring federation with existing identity infrastructure

The supported authentication architecture allows AiX to operate in standalone, cloud, on-premises, and enterprise environments without coupling the AiX application directly to a specific identity technology.

Enterprise SSO Integration

Enterprise SSO is implemented as an additional integration layer rather than embedding customer-specific identity integrations directly within the AiX application.

The logical architecture is:

AiX
 │
 ▼
AiX Auth Service
 │
 ▼
Keycloak
(AiX SSO Bridge/Gateway)
 │
 ▼
Customer Enterprise Identity Provider

This approach isolates AiX from differences between customer identity environments and provides a consistent integration point for enterprise authentication.

The detailed architecture, authentication flow, identity federation model, and Keycloak deployment options are described in AiX SSO Integration Architecture.