Skip to content
Is there an AI for this?

FDE ACADEMY · MODULE 03 · LESSON 04

Authentication, and the leaving test

Single sign-on against the identity the customer already has, groups that map to what a person may retrieve, and the check that matters: someone leaves, and the deployment knows.

Effort
Half a day if the customer’s identity provider is available to you.
Skills
identity-sso · security-hardening

Free and self-paced. No certification is offered.

Before you startYou have a reverse proxy in front of the stack from lesson 03.

01Use the identity that already exists

Every organisation past a certain size already has a directory, and a deployment with its own username list is a second one that will drift. Connect to what exists over the standard protocols. The payoff is not convenience: it is that joiners and leavers are handled by a process that already works.

If the customer’s provider is not available during the build, deploy against a self-hosted identity server so that the application only ever knows how to do single sign-on. Swapping the provider later is a configuration change; retro-fitting single sign-on onto a deployment with local accounts is a migration.

02Authentication is not authorisation

Signing in proves who someone is. It says nothing about which documents they may retrieve, and in a retrieval deployment that is the whole question — an index that ignores permissions will happily quote a document the reader was never allowed to open.

Decide early whether your first slice is a single permission domain — one collection everyone in the group may read — or whether retrieval has to respect per-document permissions. The first is a reasonable scope decision and should be written into the exclusion list. The second is a substantially larger piece of work and should be priced as one.

  • Map directory groups to collections, and write the mapping down where the customer can review it.
  • Service accounts and API keys are identities too. Give each integration its own, and rotate them.
  • Administrators should sign in as themselves. A shared admin login destroys the audit trail you built in lesson 05.

03The leaving test

The test that tells you the identity work is real: disable an account in the directory and try to use the deployment as that person. Access should fail, and any session should end within a defined window that you can state.

Do it before go-live and record the result. It is a question a security review will ask, and “we use single sign-on” is not an answer to it.

04Do this

PRACTICAL TASK

Turn on single sign-on and run the leaving test

Put the deployment behind the identity provider, map at least two groups to different access, and prove that disabling an account removes access within a stated window.

What you need

  • The customer’s identity provider, or a self-hosted one for the exercise
  • Two test accounts in different groups

Steps

  1. 01

    Work through the recipe’s single sign-on step and note which parts it cites official documentation for.

    Private knowledge base — deployment steps

  2. 02

    Create two groups with different access and sign in as each. Confirm the second account cannot retrieve what the first can.

    Keycloak

  3. 03

    Ask a retrieval question whose answer is in a document the second account may not read. Record what comes back — this is the test people skip.

  4. 04

    Disable one account in the directory. Time how long until the deployment refuses it, and write the number down.

  5. 05

    Check the recipe’s compliance notes for access control and logging, and confirm your configuration matches what they point at.

    Private knowledge base — compliance considerations

You are done when

  • Two accounts, two levels of access, demonstrated on a real retrieval question rather than a document list.
  • A disabled account loses access within a window you can state in seconds or minutes.
  • Every integration has its own credential, and none of them is shared with a person.

05Where these facts live

This lesson does not restate anything that is already recorded with its evidence elsewhere on the site. These are the pages it leans on.

  • Keycloak

    The self-hosted identity server the flagship recipe uses when the customer’s provider is not available.

  • Private company knowledge base

    Single sign-on is step seven, before hardening and before the first document is loaded.

  • A controlled AI learning environment

    Accounts a school already runs, reused rather than duplicated — and teacher visibility as an authorisation question.

Ticks are stored in your browser only. They are not sent anywhere, they are not attached to an account, and clearing your browser data removes them.