🚀 EDDI 6.5.0

19 LLM providers, knowledge bases that crawl your site and read your files, and conversations that follow compatible agent versionsWhat's new

Managed Cloud Get Started
All integrations
Identity and securityOIDC

Keycloak / OIDC

Put OpenID Connect authentication in front of EDDI with Keycloak or another OIDC provider, with roles for admins, editors, users, viewers and approvers.

ConfigurationDocs ↗

What you get

  • Login for the Manager and the API through your identity provider
  • Roles: eddi-admin, eddi-editor, eddi-user, eddi-viewer and eddi-approver for approval decisions
  • A ready-made eddi realm that the installer imports into Keycloak
  • Calls that act as the signed-in user, so the audit trail names a real person

How it works in EDDI

  1. Run the installer with --with-auth. It starts Keycloak and imports the eddi realm on first boot.
  2. Set a password for the eddi user in the Keycloak admin console. The shipped realm has none.
  3. Sign in to the Manager. Give people the roles they need and add approvers to eddi-approver.
  4. For an existing identity provider, set the QUARKUS_OIDC_* variables (tenant enabled, auth server URL, client id, client secret).
  5. In an HTTP call, use ${caller:token} to call an API with the signed-in user's own token instead of one shared credential.

Configuration

Taken from the EDDI documentation. Placeholders such as your-agent-id are yours to replace.

Install with KeycloakInstaller option that adds Keycloak.
bash install.sh --with-auth
Point EDDI at your identity providerEnvironment variables for an external OIDC provider, from the EDDI docs.
docker run -d \
  -p 7070:7070 \
  -e MONGODB_CONNECTIONSTRING='mongodb://mongo:27017/eddi?retryWrites=true&w=majority' \
  -e QUARKUS_OIDC_TENANT_ENABLED=true \
  -e QUARKUS_OIDC_AUTH_SERVER_URL='https://keycloak.example.com/realms/eddi' \
  -e QUARKUS_OIDC_CLIENT_ID=eddi \
  -e QUARKUS_OIDC_CREDENTIALS_SECRET="$OIDC_CLIENT_SECRET" \
  labsai/eddi:6.4.0

Governance

  • In production launch mode EDDI refuses to start with OIDC disabled unless you opt out explicitly, so an open management API is a decision, not an accident.
  • Approval endpoints require the eddi-approver role, or the owner or an eddi-admin.
  • With ${caller:token} the audit trail records the real user. A shared static credential would collapse every action into one principal.

Good to know

  • Authentication is optional and off by default. Keycloak is what the installer provisions. Other OIDC providers use the same settings, and some details (for example the advertised token endpoint for A2A) assume Keycloak paths unless you set them.
  • The shipped realm import is one-shot. Later edits to the JSON do not reach a running Keycloak.
Get startedDocs ↗

Related integrations

Identity and securitySecrets VaultA built-in, envelope-encrypted secrets vault. Configuration references secrets as ${vault:keyName}, and the value never lands in agent configs, exports or logs.Agent protocolsMCP ServerControl EDDI from Claude Desktop, Cursor, VS Code and other MCP clients. EDDI exposes 84 MCP tools over Streamable HTTP for conversations and administration.InfrastructureKubernetes and HelmRun EDDI on any conformant Kubernetes cluster with a single-file quickstart, a Helm chart or Kustomize overlays, with MongoDB or PostgreSQL.

Configuration and behavior on this page follow the EDDI documentation, checked on 2026-10-14. Field names and defaults can change between releases, so confirm them in the docs for your version.