Authentication & Authorization

Mon, 01 Jan 0001 00:00:00 +0000

Authentication & Authorization #

This guide covers configuring Microsoft Entra (Azure AD) authentication and authorization for temporal-operator — both server-side JWT validation for programmatic callers and UI OIDC login for human users.

Concepts #

Authentication vs. authorization #

Authentication — verifying that an incoming JWT was issued by a trusted identity provider (Microsoft Entra) and has a valid signature. Temporal performs this by fetching public keys from a JWKS endpoint and validating the token’s signature, issuer, and audience.
Authorization — deciding whether an authenticated caller may perform a specific operation on a specific Temporal namespace. Temporal’s built-in default authorizer reads a permissions claim from the JWT and maps it to per-namespace roles.

JWKS / JWT key provider #

Temporal’s frontend service fetches public keys from one or more JWKS (keySourceURIs) to validate incoming token signatures. The operator configures this through spec.authorization.jwtKeyProvider. When you set spec.authorization.entra.tenantID, the operator automatically derives the correct JWKS URL:

Operations on temporal-operator

Authentication & Authorization

Authentication & Authorization #

Concepts #

Authentication vs. authorization #

JWKS / JWT key provider #