Configure authentication
Overview
Out-of-the-box, CAST Imaging is configured to use Local Authentication via a simple username/password system provided by third-party component called Keycloak (see below for more information). A default CAST Imaging local user is provided (with the login credentials admin/admin and with the global ADMIN profile) so that installation can be set up initially.
To manage and configure authentication, i.e. to manage existing local CAST Imaging user credentials and the addition of new local users/groups, or to change the authentication system to interact with your in-house LDAP/Active Directory or SAML system, connect to the Keycloak authentication system using the following URL (pointing to the machine on which the imaging-services component is installed) and login with the kcadmin account (see Keycloak accounts and passwords for details):
http://<imaging-services-fqdn>:8090/auth
A fresh installation provides several distinct accounts, some of which share the same default password. For an explanation of each account, what it is for, and how to change its password, see Keycloak accounts and passwords.
CAST recommends configuring CAST Imaging to use your on-premises enterprise authentication system such as LDAP or SAML Single Sign-on, as detailed below:
About Keycloak
CAST uses a third-party component called Keycloak to handle authentication for CAST Imaging. This component is installed automatically during the install process. Some technical information about Keycloak follows:
Keycloak login credentials
A fresh installation provides several distinct accounts:
kcadminin themasterrealm - the account used to log in to the Keycloak admin UIadminin themasterrealm - an internal service account used for communication between CAST Imaging services, not intended for UI loginadminand any further local users in theaip-realmrealm - used to log in to CAST Imaging itself
These accounts are entirely separate and distinct. In releases up to 3.6.5-funcrel they share the same default password (admin), which is why they are often mistaken for a single account. From 3.6.6-funcrel a fresh installation generates a random password for the admin service account on Linux via Docker/Podman and Kubernetes deployments, but not on Microsoft Windows.
For a full explanation of each account, the default password for each release, and the correct procedure for changing each password on every deployment type, see Keycloak accounts and passwords.
Product support
CAST supports this third-party component in the sense that tickets are created, and temporary or permanent fixes will be provided.
Version upgrades
When a permanent fix is required, CAST provides the latest corrections published by Keycloak.
Error management
CAST handles Keycloak errors when they are reported via support tickets.
Configuration and parameterization issues
As mentioned previously, CAST handles configuration issues when support tickets are created.
Software and security patching
When patching is required, CAST provides patches sourced from Keycloak.