GBLI Authz PoC
Login
Identity relationships

Relationship Admin

User-to-agency memberships from seed-data.json and Org API. Identity = email. Authz = inline rules.

Migration Demo

Use the same legacy identity through each stage. Keycloak decides which upstream IdP to use while the app continues to see the same business user.

Stage 1: Okta is primaryStage 2: Link Authbeast onceStage 3: Route to Authbeast
StageUser doesWhat happens
1atlasAlice@legacy.local logs in with Okta password Demo1234!Keycloak routes to Okta and the app signs in as Alice Smith.
2Admin marks the same legacy user for federation, then the user clicks the link action after the Okta loginThe app starts Keycloak's supported account-link flow. User signs in once with the Authbeast account and returns to the app.
3User enters the same legacy email againKeycloak sees the Authbeast link and routes straight to Authbeast instead of Okta.

After the Stage 1 Okta login, use the Launchpad action to start the one-time Authbeast link.

Legacy identity stays the same in the app. Old and new IdPs can run side by side during migration. Okta can be removed later after users are linked.

How authorization works

1. Keycloak → OIDC token (userId=email, agency, subagency).
2. Web app resolves user via Org API using email.
3. Authz service uses Org API + inline rules (role, agency, jurisdiction, product, lifecycle, training).
4. Decision Viewer shows the full trace with rationale.

Design decision: email = user

Identity key is userId (email). 1 email = 1 user globally. Agency and subagency are membership context, not identity.

Active users and memberships

EmailRoleAgencyJurisdictions
ann.rivera@gmail.comagentAtlas AgencyNY
brian.cho@gmail.comunderwriterAtlas AgencyNY, CA
carla.ng@gmail.combilling_specialistAtlas AgencyNY
dan.lee@outlook.comagentSummit BrokerageNY
eva.morris@outlook.comagentSummit BrokerageNY
frank.owen@outlook.comagentSummit BrokerageNY
atlasaliceagentAtlas AgencyNY
atlasbobunderwriterAtlas AgencyNY, CA
atlascarlabilling_specialistAtlas AgencyNY
summitdanagentSummit BrokerageNY
summitevaagentSummit BrokerageNY