This documentation is available to agents as Markdown at https://docs.synthesized.io/tdk/latest/user_guide/060_security_compliance/authentication.md. For the complete documentation index, see llms.txt.

Authentication

Users sign in to Governor with an email and password, through single sign-on, or with their directory account. Pipelines use access keys. This page compares the options.

Sign-in methods

Method Use it for Roles

Email and password

Small teams, and a break-glass administrator. The first administrator is created from ADMIN_EMAIL and ADMIN_DEFAULT_PASSWORD; administrators create the other users. See Administration.

Set in Governor.

OAuth2: Google, Microsoft, GitHub, PingFederate

Signing in with an existing account at one of these providers. See OAuth2.

Set in Governor.

SAML: Microsoft Entra ID, Google

Enterprise single sign-on, with roles from your identity provider’s groups. See SAML.

Set in Governor, or taken from SAML groups at each sign-in.

Kerberos, through your identity provider

Single sign-on from computers in your Windows domain. Your identity provider signs users in with Kerberos, for example through Windows integrated authentication, and then signs them in to Governor with SAML or OAuth2. Set up single sign-on, and turn on Kerberos in your identity provider.

As for SAML or OAuth2.

LDAP and Active Directory

Signing in with a directory account, checked against your LDAP server or Active Directory. See LDAP and Active Directory.

Set in Governor, or taken from LDAP groups.

Access keys

Scripts and pipelines that call the REST API. A key acts as the user who created it. See Generating a New Access Key.

The roles of the user who created the key.

You can set up more than one method. The sign-in page shows a button for each SSO provider you configure.

Sessions

A signed-in session uses an access token that lasts one day and a refresh token that lasts 60 days, by default. Change them with JWT_ACCESS_TOKEN_EXPIRATION and JWT_REFRESH_TOKEN_EXPIRATION. See Governor and Worker Settings.

With SAML, signing out ends the Governor session. Turn on Single Logout to sign out of the identity provider too.

Database authentication

How the platform authenticates to your databases is separate from how users sign in:

  • A user name and password stored with the data source, encrypted in Governor’s metadata database.

  • A reference to a secret in AWS Secrets Manager, Google Cloud Secret Manager or HashiCorp Vault. See Secret Managers.

  • Kerberos, for databases that require it. This is separate from Kerberos sign-in through your identity provider. See Kerberos for database connections.

  • No authentication, for Db2, MySQL and PostgreSQL data sources whose driver gets its credentials from the JDBC URL or the worker’s environment. See Data Sources.

Related pages