Accounts vs Users
The distinction between Accounts and Users in Stroom.
Setting up Stroom with an Open ID Connect IDP
How to set up Stroom to authenticate users: with its own internal identity provider, with a 3rd party one such as KeyCloak, Cognito or Google, or behind an authenticating proxy such as an AWS Application Load Balancer.
Stroom authenticates its users against an
Identity Provider (IDP)
Identity Provider (IDP)
An Identity Provider is a system or service that can authenticate a user and assert their identity. Identity providers can support single sign on (SSO), which allows the user to sign in once to the Identity Provider so they are then authenticated to all systems using that IDP.Click to see more details... using
Open ID Connect
.
There are three deployment models, distinguished by where the user accounts live and which component performs the sign in.
- Internal IDP - Stroom acts as its own identity provider and manages the user accounts itself. This is the default.
- External IDP - A 3rd party identity provider, such as KeyCloak, Cognito or Google, holds the accounts; Stroom performs the sign in by redirecting the browser to it.
- Edge Proxy RP - A 3rd party identity provider holds the accounts, but an authenticating reverse proxy in front of Stroom performs the sign in (an AWS Application Load Balancer, NGINX with oauth2-proxy, etc., against Cognito, Entra ID, KeyCloak or any other provider) and passes Stroom a verified identity with each request.
Not sure which you have?
| Your situation | Model |
|---|---|
| No existing identity provider, or Stroom should manage its own accounts | Internal IDP |
| An existing IDP (KeyCloak, Cognito, Google, Entra ID) and browsers reach Stroom directly, or through a proxy that only routes | External IDP |
A load balancer or proxy in front of Stroom signs users in before traffic reaches it, e.g. an ALB authenticate-cognito or authenticate-oidc rule, oauth2-proxy, or a policy that unauthenticated traffic must not reach the application |
Edge Proxy RP |
Whichever you use, authorisation is always handled by Stroom. The provider establishes who a user is; Stroom decides what they are allowed to do.
See Also
See Accounts and Users for how identities at the provider relate to Stroom users, and Tokens for API use for authenticating machine to machine.
Stroom's Internal IDP
Details about Stroom’s own internal identity provider and authentication mechanisms.
External IDP
How to set up Stroom to use a 3rd party identity provider such as KeyCloak, Cognito or Google for authentication.
Edge Proxy as the Relying Party
Running Stroom behind an authenticating reverse proxy, such as an AWS Application Load Balancer or NGINX with oauth2-proxy, that completes the Open ID Connect flow itself against Cognito, Entra ID, KeyCloak or any other provider.
Tokens for API use
How to create and use tokens for making API calls.
Insecure Test Credential
An optional shared secret for wiring Stroom and Stroom-Proxy together in test or demonstration environments.
Last modified October 20, 2026: Merge pull request #144 from gchq/add-7.14-rel-notes (2c6fb22)