> For the complete documentation index, see [llms.txt](https://docs.duplocloud.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.duplocloud.com/docs/automation-platform/access-control.md).

# User Administration

## Access roles

The DuploCloud Portal contains the following access roles:

* An **Administrator** has access to all Tenants plus access to administrative functions like Plan configuration, system dashboards, system defaults, etc.
* A **User** is a regular user that can be given access to a specific Tenant. A Tenant can be accessed by multiple users and a user can be given access to multiple Tenants.
* The **Security** role is for security and compliance auditors, in order to verify security and compliance dashboards and reports.

## Read Only Permissions

For each of the access roles above, DuploCloud supports Read Only permissions, which restrict a user to "view" the resources that are in scope of that particular role but prevents them from making any updates to those resources. Read Only permissions also prevent Just-In-Time access to the underlying Cloud platform.

## Single Sign On (SSO)

The user name is meant to be an email address associated with an Identity provider. Currently, supported identity providers are Google and Microsoft Azure. Once a user is created in the DuploCloud portal, the user receives an account-creation email with login instructions. No passwords are involved, the user simply has to navigate to their DuploCloud environment and use SSO to log in to their account.

![](/files/JKRJEU2Qm0vQoZDrnVfr)

## Keycloak Integration

DuploCloud supports using [Keycloak](https://www.keycloak.org/) to integrate with external identity providers. For example, integrating LDAP directories (such as Active Directory (AD) or OpenLDAP) provides centralized authentication and user federation without requiring local DuploCloud accounts. Additional identity providers (e.g., OpenID Connect (OIDC) and SAML systems) can be integrated as needed.

{% hint style="info" %}
**Note**: Keycloak integration requires setup and configuration. Please contact **DuploCloud Support** for assistance with enabling and connecting your identity provider.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.duplocloud.com/docs/automation-platform/access-control.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.