Skip to main content

Identity and directory

Stacklok Enterprise

The directory service is a component of Stacklok Enterprise. For a full comparison of ToolHive Community and Stacklok Enterprise capabilities, see Stacklok Enterprise.

The directory stores identities and group memberships used by the Connector Gateway and AI Gateway. Administrators manage these records through the console or API.

What it holds​

RecordUsed for
UsersResolve tokens and assign user budgets
Groups and subgroupsGrant connector access and assign group budgets
Identity providersBroker OAuth from connectors to upstream services
Managed secretsStore connector and identity provider credentials
Virtual API keysAuthenticate automated clients as a directory user

How identity is resolved​

The directory maps the issuer and subject in a caller's token to a user record. It returns the user's direct and inherited group memberships to the requesting component. Controls that require a directory identity deny callers without a matching record.

warning

Connector access and budgets use directory groups. Cluster authorization policy uses OIDC claim groups. See Directory groups and OIDC claim groups.

Where you administer it​

Use User management for users, groups, and subgroups. Use Identity providers and Managed secrets for connector authentication. Users manage their virtual keys under API keys in Your workspace.

The platform admin grant covers directory and budget administration. Use the /v1 API for automation and bulk changes.

Contents​