# Web UI User Authorization

**URL:** <https://community.temporal.io/t/web-ui-user-authorization/18523>\
**Category:** Server Deployment\
**Tags:** auth, web-ui, sso\
**Created:** [October 16, 2025, 1:44pm UTC](https://community.temporal.io/t/web-ui-user-authorization/18523 "2025-10-16T13:44:30Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Galo](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/galo/32/7884_2.png) [@Galo](https://community.temporal.io/u/Galo)\
**Post date:** [October 16, 2025, 1:44pm UTC](https://community.temporal.io/t/web-ui-user-authorization/18523/1 "2025-10-16T13:44:30Z")

</div>

We’re self-hosting Temporal and have integrated it with our SSO provider via OIDC. Authentication works well; Users can log in through our identity provider and reach the Temporal UI.

Our question is about authorization: we’d like to restrict access so that only certain users (for example, members of a specific group or role) can log in or view workflows. Right now, anybody who can authenticate can just log in and see everything.

We’re wondering:

- Is there a recommended way to enforce fine-grained access control for the Temporal UI?
- Can Temporal be configured to validate roles, groups, or claims in the identity token?
- If not natively supported, what’s the best pattern to handle this — via a reverse proxy, middleware, or a custom auth service?

Any guidance, examples, or patterns others have used for access restriction in self-hosted deployments would be greatly appreciated.

(We are using Keycloak, but wanted to keep the question broad to make it useful for others who are using other providers like Okta, Authenthicc, etc)

---

<div class="post-metadata">

**Author:** ![antonio.perez](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/antonio.perez/32/2417_2.png) [@antonio.perez](https://community.temporal.io/u/antonio.perez)\
**Post date:** [October 21, 2025, 11:12am UTC](https://community.temporal.io/t/web-ui-user-authorization/18523/2 "2025-10-21T11:12:50Z")

</div>

Hi

let me know if this helps

- [Temporal Platform security features | Temporal Platform Documentation](https://docs.temporal.io/self-hosted-guide/security#authorizer-plugin)
- [samples-server/extensibility/authorizer at main · temporalio/samples-server · GitHub](https://github.com/temporalio/samples-server/tree/main/extensibility/authorizer)

Antonio

---

<div class="post-metadata">

**Author:** ![Galo](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/galo/32/7884_2.png) [@Galo](https://community.temporal.io/u/Galo)\
**Post date:** [October 29, 2025, 10:39pm UTC](https://community.temporal.io/t/web-ui-user-authorization/18523/3 "2025-10-29T22:39:49Z")

</div>

> [@antonio.perez](#):
>
> let me know if this helps

It did help! Thanks so much! But now I am running into another issue which I’ve posted about here:

> [@How does internal service auth work with default Authorizer/Claim Mapper?](https://community.temporal.io/t/how-does-internal-service-auth-work-with-default-authorizer-claim-mapper/18610):
>
> Hello, I’m trying to enable authentication and authorization using the default authorizer and default claim mapper in a Temporal deployment, but internal services are failing to authorize. Setup Image: temporalio/server:1.29 (stock image) Config: - TEMPORAL\_AUTH\_AUTHORIZER=default - TEMPORAL\_AUTH\_CLAIM\_MAPPER=default When these are enabled the service worker crashes with Request unauthorized. It appears that the built-in services (history, matching, worker, etc.) do not send JWTs by d…