# How to create Single Sign-On (SSO) users on CubeCOS

> Learn how to create users in CubeCOS through Single Sign-On (SSO) using Keycloak as the identity provider. This approach enables centralized authentication and seamless access across integrated systems.

## Single sign-on users overview {#single-sign-on-users-overview}

This guide explains how to create users through **Single-Sign-On (SSO)** integration using **Keycloak** as the identity provider. SSO user creation allows centralized authentication management and seamless access across multiple systems.

**When to use SSO User Creation:**

- When integrating with existing enterprise identity systems
- For environments requiring centralized authentication
- When you want users to use the same credentials across multiple services
- For organizations with established LDAP/Active Directory infrastructure

## Explore differences between SSO and local users {#explore-differences-between-sso-and-local-users}

| Feature             | SSO (Keycloak)                     | Local User Creation              |
| ------------------- | ---------------------------------- | -------------------------------- |
| **Authentication**  | Centralized through Keycloak       | Managed within CubeCOS           |
| **User Management** | External identity provider         | Direct CubeCOS administration    |
| **Password Policy** | Managed by Keycloak                | Managed by CubeCOS               |
| **Integration**     | Requires Keycloak setup            | No external dependencies         |
| **Scalability**     | Excellent for large organizations  | Suitable for smaller deployments |
| **Security**        | Enterprise-grade SSO               | Local password management        |
| **User Experience** | Single login for multiple services | Separate login for CubeCOS       |

## Prerequisites {#prerequisites}

- Keycloak server configured and accessible
- Administrator access to Keycloak management console
- Understanding of SSO authentication flow

## Create SSO users {#create-sso-users}

1. Log into the CubeCOS management interface at `https://<your-cluster-ip-address>`.
2. Navigate to `Keycloak`

   ![/assets/identity/asset_iam.png](/assets/identity/asset_iam.png)

3. On the sidebar, look for `Manage > Users` and click on `Add user`

   ![/assets/keycloak/sso-01.png](/assets/keycloak/sso-01.png)

4. Enter a new username

   ![/assets/keycloak/sso-02.png](/assets/keycloak/sso-02.png)

5. Set the password

   ![/assets/keycloak/sso-03.png](/assets/keycloak/sso-03.png)

6. (Optional) Add user to `cube-admins` group

   ![/assets/keycloak/sso-04.png](/assets/keycloak/sso-04.png)

## Assign permissions to SSO users {#assign-permissions-to-sso-users}

Follow [7-Assign users to project](./assign-to-project.md) to assign SSO user to the appropriate project.

## Login as SSO users {#login-as-sso-users}

1. Navigate to the CubeCOS management interface at `https://<your-cluster-ip-address>`.
2. Enter your SSO user credentials and click login.
3. Navigate to `Integration > OpenStack` to enter OpenStack management.

   ![/assets/identity/admin-identity-home-page-1.png](/assets/identity/admin-identity-home-page-1.png)

4. Click on `Connect` for the OpenStack integration.

   ![/assets/identity/admin-identity-integration-nav-2.png](/assets/identity/admin-identity-integration-nav-2.png)

5. A new management interface will open in a new tab, click on `Login` when prompted.

   ![/assets/identity/admin-identity-login.png](/assets/identity/admin-identity-login.png)

6. Verify that login is successful and the project switcher shows the correct project the user is assigned to.

   ![/assets/identity/admin-verify-admin-project-created.png](/assets/identity/admin-verify-admin-project-created.png)

7. You have completed creating a new SSO user, assigning the user to a project, and verifying user access to the project.