Authentication for deployments

Perforce Unified Compliance deployments use Keycloak as the built-in identity layer. Keycloak runs on the appliance under the /idp path and handles all login, token issuance, and role resolution for the product.

Two authentication modes are supported:

  • External identity provider (SSO) — users log in through your organization's existing identity provider (IdP), such as Okta, Azure AD / Entra ID, or PingFederate. Keycloak acts as a broker: it redirects the login to your IdP, receives a signed token back, and maps roles for the user in the app. The appliance never stores user passwords.

  • Local Keycloak users — users are created and managed directly in Keycloak's admin console. This mode is suitable when an external IdP is not available or when you need service accounts that are not managed in a corporate directory.

Both modes can be active at the same time. A deployment can have some users authenticating through an external IdP and others logging in with local Keycloak credentials.

When to use each mode

Mode

Use when

External IdP (SSO)

Your organization uses a central identity provider and you want users to log in with their existing credentials. Role and group management stays in your IdP.

Local Keycloak users

You are in an air-gapped environment, you need service accounts for integrations such as pe-bridge or MCP, or an external IdP is not available for this deployment.

Next steps