Authentication

Authentication decides how people reach your self-hosted Allure TestOps instance and how sign-in fits into your existing identity landscape. The next step is to choose the provider model and then connect it to Allure TestOps access behavior.

Choose the authentication method

• System authentication
• LDAP
• OpenID Connect
  • Azure AD OpenID example
  • Keycloak OpenID example
• SAML2
  • Generic SAML 2.0 explanation
  • Okta SAML 2.0 example

Roles for users from an external identity provider

A company directory usually contains many people who only need to look at test results, and every account with the User or Admin role consumes a license seat. A common setup is:

• set the default role to ROLE_GUEST, so anyone from the directory can sign in with read-only access without consuming a seat;
• list the groups whose members need ROLE_USER or ROLE_ADMIN;
• enable role synchronization (syncRoles).

With role synchronization enabled, Allure TestOps sets the role on every sign-in from the user's groups. If a user belongs to several listed groups, the role with more permissions applies. A user who is not in any listed group gets the default role. Without role synchronization, the role is set only when the account is created at the first sign-in, and later changes in the directory do not affect it.

Creating an account with the User or Admin role requires a free license seat. If no seat is available, the sign-in fails.

These roles are instance-wide. To work in a private project, Guests and Users still need to be added to that project, see Project access model.

For the parameter names, see LDAP, OpenID Connect, and SAML 2.0.

After sign-in works

• Use Users and access for instance roles and permissions.

Keep a local recovery path

If your main sign-in flow uses LDAP, OpenID, or SAML, keep the built-in system login reachable for recovery scenarios. The local login is the path to use when:

• the external identity provider is unavailable or misconfigured;
• you need to enter a new license after expiration;
• the only remaining administrator must sign in outside the external IAM flow.

To sign in with a local account, select Username and password in the Authentication method list on the sign-in page. In versions before 26.3.1, use <your TestOps URL>/login/system instead. For the local-account workflow itself, see System authentication.