Adding Role-Based Authorization to Temporal

Community Support
, ,
1

Hello everyone,

I am trying to add Role-Based Authorization (RBAC) to our corporate Temporal deployment, and I’m struggling to understand how authorization should be enforced outside of the Temporal UI.

Our setup looks like this:

  1. We have a corporate IAM Proxy that sits in front of internal applications.
  2. Users authenticate through the IAM Proxy and receive a JWT after successful login.
  3. The JWT is then used to authorize access to Temporal UI, which makes sense to me.

However, I am confused about how RBAC works when users interact with Temporal through an SDK instead of the UI.

For example:

  • A user writes a Python or Go application.
  • The application creates a Temporal client and starts workflows directly via the SDK.
  • In this case, the user can completely bypass the IAM Proxy and Temporal UI.

My questions are:

  1. How can I restrict which users are allowed to start specific workflows?
  2. How can I enforce RBAC when clients connect directly to Temporal through the SDK?
  3. Is the recommended approach to require authentication and authorization at the Temporal server level (e.g., mTLS, JWT, custom authorizer), rather than relying on the UI?
  4. How do organizations typically prevent someone from writing their own Temporal client and invoking workflows they should not have access to?

I feel like I am missing a fundamental piece of the architecture. If authorization only exists in front of the UI, it seems that anyone with network access to Temporal could bypass those controls by using an SDK directly.

Any guidance or examples of production RBAC architectures for Temporal would be greatly appreciated.

Thanks!

2

Hi Merlin,

You should treat the UI as an untrusted client just like every SDK. You should not put auth in front of your Temporal UI. You should enforce it at Temporal level. Check out ClaimMapper and Authorizer at this guide here: Temporal Platform security features | Temporal Platform Documentation

3

Checkout this blog article: Implementing Role-Based Authentication for Self-Hosted Temporal

4

The problem is that our IAMProxy client sits before any app and in the end returns JWT after a correct login.