# \#auth **URL:** https://community.temporal.io/tag/auth/39.md [Latest](https://community.temporal.io/latest.md) · [Categories](https://community.temporal.io/categories.md) · [Tags](https://community.temporal.io/tags.md) --- ## [How does internal service auth work with default Authorizer/Claim Mapper?](https://community.temporal.io/t/how-does-internal-service-auth-work-with-default-authorizer-claim-mapper/18610)
**Author:** [@Galo](https://community.temporal.io/u/Galo)\ **Replies:** 2\ **Last updated:** [July 8, 2026, 12:00pm UTC](https://community.temporal.io/t/how-does-internal-service-auth-work-with-default-authorizer-claim-mapper/18610 "2026-07-08T12:00:48Z")
Hello, I’m trying to enable authentication and authorization using the default authorizer and default claim mapper in a Temporal deployment, but internal services are failing to authorize. Setup Image: temporalio/ser… --- ## [Adding Role-Based Authorization to Temporal](https://community.temporal.io/t/adding-role-based-authorization-to-temporal/19665)
**Author:** [@merlin001](https://community.temporal.io/u/merlin001)\ **Replies:** 3\ **Last updated:** [June 15, 2026, 4:51pm UTC](https://community.temporal.io/t/adding-role-based-authorization-to-temporal/19665 "2026-06-15T16:51:36Z")
Hello everyone, I am trying to add Role-Based Authorization (RBAC) to our corporate Temporal deployment, and I’m struggling to understand how authorization should be enforced outside of the Temporal UI. Our setup looks… --- ## [Accessing UI with defaultAuthorize requires system (or temporal-system) reader access](https://community.temporal.io/t/accessing-ui-with-defaultauthorize-requires-system-or-temporal-system-reader-access/8685)
**Author:** [@nick.williams](https://community.temporal.io/u/nick.williams)\ **Replies:** 1\ **Last updated:** [November 10, 2025, 10:40pm UTC](https://community.temporal.io/t/accessing-ui-with-defaultauthorize-requires-system-or-temporal-system-reader-access/8685 "2025-11-10T22:40:37Z")
The Temporal UI uses some 'readOnlyGlobalAPI’s (like list namespaces) in order to function. In order to use the UI and the defaultAuthorizer and defaultJWTClaimMapper I before v1.21.0 required any user to have a system:r… --- ## [Auth/Authorization](https://community.temporal.io/t/auth-authorization/5017)
**Author:** [@pradnya.bhalekar](https://community.temporal.io/u/pradnya.bhalekar)\ **Replies:** 3\ **Last updated:** [November 6, 2025, 3:18pm UTC](https://community.temporal.io/t/auth-authorization/5017 "2025-11-06T15:18:26Z")
I use keycloak to generate JWT token: and have provided keycloak url for public key decode: “TEMPORAL\_JWT\_KEY\_SOURCE1=http://keycloak:8080/auth/realms/temporal/protocol/openid-connect/certs” “TEMPORAL\_AUTH\_AUTHORIZER… --- ## [Web UI User Authorization](https://community.temporal.io/t/web-ui-user-authorization/18523)
**Author:** [@Galo](https://community.temporal.io/u/Galo)\ **Replies:** 2\ **Last updated:** [October 29, 2025, 10:39pm UTC](https://community.temporal.io/t/web-ui-user-authorization/18523 "2025-10-29T22:39:49Z")
We’re self-hosting Temporal and have integrated it with our SSO provider via OIDC. Authentication works well; Users can log in through our identity provider and reach the Temporal UI. Our question is about authorization… --- ## [Required Claim Mapper Permissions for Worker Service](https://community.temporal.io/t/required-claim-mapper-permissions-for-worker-service/14972)
**Author:** [@Aaron\_Huntress](https://community.temporal.io/u/Aaron_Huntress)\ **Replies:** 3\ **Last updated:** [May 30, 2025, 12:35pm UTC](https://community.temporal.io/t/required-claim-mapper-permissions-for-worker-service/14972 "2025-05-30T12:35:04Z")
We’ve build a custom claim mapper (all custom) and a customized authorizer (uses much of the default authorizer), and it’s a bit unclear what permissions are actually required by the worker service. I initially thought … --- ## [Python client not able to connect to self-hosted Temporal server via proxy using authorization header](https://community.temporal.io/t/python-client-not-able-to-connect-to-self-hosted-temporal-server-via-proxy-using-authorization-header/17035)
**Author:** [@Dipali](https://community.temporal.io/u/Dipali)\ **Replies:** 0\ **Last updated:** [April 3, 2025, 12:47am UTC](https://community.temporal.io/t/python-client-not-able-to-connect-to-self-hosted-temporal-server-via-proxy-using-authorization-header/17035 "2025-04-03T00:47:13Z")
Hi team, We’re trying to connect Python client(SDK version v1.10.0) to our self-hosted Temporal server(version v1.26.2) via a proxy using an authorization header. We see that it is able to connect to the worker at start… --- ## [How to configure SSO with GitHub](https://community.temporal.io/t/how-to-configure-sso-with-github/15439)
**Author:** [@tired-devops](https://community.temporal.io/u/tired-devops)\ **Replies:** 1\ **Last updated:** [December 10, 2024, 9:14am UTC](https://community.temporal.io/t/how-to-configure-sso-with-github/15439 "2024-12-10T09:14:59Z")
I have temporal deployed via the official helm chart (version 0.51.0). I’m trying to enable SSO via GitHub OAuth App on the web UI. Here’s the relevant part of my values.yaml web: ingress: enabled: true clas… --- ## [Temporal SSO: RSA key not found for key ID](https://community.temporal.io/t/temporal-sso-rsa-key-not-found-for-key-id/14947)
**Author:** [@OhMyDeera](https://community.temporal.io/u/OhMyDeera)\ **Replies:** 2\ **Last updated:** [November 1, 2024, 4:14pm UTC](https://community.temporal.io/t/temporal-sso-rsa-key-not-found-for-key-id/14947 "2024-11-01T16:14:34Z")
Hi, I was hoping for some insight in an issue I’ve been facing with getting SSO enabled and working for temporal. I’ve got a temporal service running locally setup with mTLS and the relevant Auth options, however I get … --- ## [JWT Auth with Keycloak, Key ID not found](https://community.temporal.io/t/jwt-auth-with-keycloak-key-id-not-found/12420)
**Author:** [@maxagain](https://community.temporal.io/u/maxagain)\ **Replies:** 2\ **Last updated:** [August 13, 2024, 11:18am UTC](https://community.temporal.io/t/jwt-auth-with-keycloak-key-id-not-found/12420 "2024-08-13T11:18:50Z")
Hi all Just wondering if I could get a little hand with some issues I’m facing integrating the Temporal server’s default JWT Auth with Keycloak. I’ve been following guide here, and I believe I’ve set everything up corre… --- ## [Can you restrict worker client to have access to only one specific queue?](https://community.temporal.io/t/can-you-restrict-worker-client-to-have-access-to-only-one-specific-queue/13024)
**Author:** [@Igor\_Polynets1](https://community.temporal.io/u/Igor_Polynets1)\ **Replies:** 0\ **Last updated:** [July 31, 2024, 11:14pm UTC](https://community.temporal.io/t/can-you-restrict-worker-client-to-have-access-to-only-one-specific-queue/13024 "2024-07-31T23:14:44Z")
I’m considering using Temporal to distribute calls to my clients, where I have agents (workers) running. I want to direct calls to specific server workers based on dedicated queues, similar to the example: Worker-Specifi… --- ## [Authorization, Untrusted workflow creation and namespace authentication](https://community.temporal.io/t/authorization-untrusted-workflow-creation-and-namespace-authentication/632)
**Author:** [@macsinte](https://community.temporal.io/u/macsinte)\ **Replies:** 21\ **Last updated:** [July 29, 2024, 2:14pm UTC](https://community.temporal.io/t/authorization-untrusted-workflow-creation-and-namespace-authentication/632 "2024-07-29T14:14:48Z")
Hello all, I have a question on the authorization around Temporal that’s existent at this point. Can we contribute to anything ASAP and/or use anything existent that would prevent tenants from seeing/accessing/subscri… --- ## [Custom Claim Mapper](https://community.temporal.io/t/custom-claim-mapper/12706)
**Author:** [@agasser4324](https://community.temporal.io/u/agasser4324)\ **Replies:** 0\ **Last updated:** [July 1, 2024, 12:59pm UTC](https://community.temporal.io/t/custom-claim-mapper/12706 "2024-07-01T12:59:47Z")
Hello all, I am trying to enable a custom claim mapper for our self-hosted Temporal server. We already have a JWT that is passed to the Temporal frontend, but now I need to map our claims to existing Temporal roles in o… --- ## [Serverjwtauth temporal start failed](https://community.temporal.io/t/serverjwtauth-temporal-start-failed/9676)
**Author:** [@luis\_chan](https://community.temporal.io/u/luis_chan)\ **Replies:** 4\ **Last updated:** [May 22, 2024, 12:28pm UTC](https://community.temporal.io/t/serverjwtauth-temporal-start-failed/9676 "2024-05-22T12:28:36Z")
I am following Temporal JWT Authorization this example and trying to make the JWT work. I started the jwks server and change the port to 61884. go run ./serverjwtauth/key gen-and-serve I used the docker-compose.yml an… --- ## [HTTP 503 when UI tries to 'DescribeNamespace'](https://community.temporal.io/t/http-503-when-ui-tries-to-describenamespace/9445)
**Author:** [@adithyasai](https://community.temporal.io/u/adithyasai)\ **Replies:** 2\ **Last updated:** [September 12, 2023, 2:06am UTC](https://community.temporal.io/t/http-503-when-ui-tries-to-describenamespace/9445 "2023-09-12T02:06:42Z")
I upgraded my cluster from 1.16.x to 1.22.0, and I have configured a default jwt authorizer. I am also using postgres12 driver for my cluster. After logging into the temporal web UI, a network call is made to 'api/v1/na… --- ## [Securing the Temporal UI](https://community.temporal.io/t/securing-the-temporal-ui/7485)
**Author:** [@Carlos.R](https://community.temporal.io/u/Carlos.R)\ **Replies:** 0\ **Last updated:** [March 6, 2023, 6:21pm UTC](https://community.temporal.io/t/securing-the-temporal-ui/7485 "2023-03-06T18:21:42Z")
Hi all, If i am running the temporal server locally from the docker-compose repo, where do I place the development.yaml file to update the UI config? I’ve tried adding it to the /dynamicconfig folder but seems to not do… --- ## [Temporal custom authorization using JWT](https://community.temporal.io/t/temporal-custom-authorization-using-jwt/6200)
**Author:** [@reshefsh](https://community.temporal.io/u/reshefsh)\ **Replies:** 2\ **Last updated:** [October 23, 2022, 6:35pm UTC](https://community.temporal.io/t/temporal-custom-authorization-using-jwt/6200 "2022-10-23T18:35:23Z")
Hello, I want to implement a customer authorizer that will validate a JWT sent using JWTHeadersProvider. I wrote the implementation, but am wondering how to integrate it so the server knows and uses it? I use both tem… --- ## [Authentication for internal requests](https://community.temporal.io/t/authentication-for-internal-requests/5675)
**Author:** [@JerryHu](https://community.temporal.io/u/JerryHu)\ **Replies:** 2\ **Last updated:** [August 16, 2022, 10:05pm UTC](https://community.temporal.io/t/authentication-for-internal-requests/5675 "2022-08-16T22:05:49Z")
Hi all, I’ve successfully set up the SSO integration with Okta in Temporal Web and added custom logic in authorizer and claim mapper. But for internal traffic like from other services to the frontend service, the incomi… --- ## [AuthorizationTokenSupplier queries](https://community.temporal.io/t/authorizationtokensupplier-queries/4531)
**Author:** [@Ruchir](https://community.temporal.io/u/Ruchir)\ **Replies:** 1\ **Last updated:** [April 25, 2022, 3:20pm UTC](https://community.temporal.io/t/authorizationtokensupplier-queries/4531 "2022-04-25T15:20:22Z")
Hi Experts, Can a function be passed as a AuthorizationTokenSupplier , for eg: AuthorizationTokenSupplier tokenSupplier = () -\> return restTemplate.get("http-endpoint-which-returns-jwt-tokens"); Also, in one scenario,… --- ## [Does temporal authorization help in authorizing creation of child workflows?](https://community.temporal.io/t/does-temporal-authorization-help-in-authorizing-creation-of-child-workflows/4325)
**Author:** [@sp13](https://community.temporal.io/u/sp13)\ **Replies:** 5\ **Last updated:** [March 31, 2022, 8:56pm UTC](https://community.temporal.io/t/does-temporal-authorization-help-in-authorizing-creation-of-child-workflows/4325 "2022-03-31T20:56:50Z")
Hello we have an implementation of custom authorizer to control the StartWorkflowExecution through a defined set of permissions. A subject → namespace mapping determines which subject can create workflows in which names… --- ## [Extending the custom authorisation (JWT) to the System Worker](https://community.temporal.io/t/extending-the-custom-authorisation-jwt-to-the-system-worker/3408)
**Author:** [@Andrey\_Dubnik](https://community.temporal.io/u/Andrey_Dubnik)\ **Replies:** 8\ **Last updated:** [December 28, 2021, 10:58am UTC](https://community.temporal.io/t/extending-the-custom-authorisation-jwt-to-the-system-worker/3408 "2021-12-28T10:58:28Z")
Hi, my team is building the internal multi-tenant platform for the microservices orchestration and I’m currently looking at options in getting the authorisation done via the JWT access token. I hope someone can help brin… --- ## [Is there any way to have access control on the Cadence/Temporal dashboard?](https://community.temporal.io/t/is-there-any-way-to-have-access-control-on-the-cadence-temporal-dashboard/565)
**Author:** [@Akshay\_Goyal](https://community.temporal.io/u/Akshay_Goyal)\ **Replies:** 6\ **Last updated:** [February 27, 2021, 8:22pm UTC](https://community.temporal.io/t/is-there-any-way-to-have-access-control-on-the-cadence-temporal-dashboard/565 "2021-02-27T20:22:47Z")
Is there any way to have access control on the Cadence/Temporal dashboard? Also would br great if we can have access control over domain/namespaces. --- ## [Untrusted workflow execution](https://community.temporal.io/t/untrusted-workflow-execution/580)
**Author:** [@david](https://community.temporal.io/u/david)\ **Replies:** 6\ **Last updated:** [September 22, 2020, 10:02pm UTC](https://community.temporal.io/t/untrusted-workflow-execution/580 "2020-09-22T22:02:03Z")
Do you folks support security for untrusted workflow execution? Eg enable external users to execute workflows zapier style (optionally allowing them to run arbitrary code) --- ## [Context Propagation sample not working](https://community.temporal.io/t/context-propagation-sample-not-working/154)
**Author:** [@moh\_abk](https://community.temporal.io/u/moh_abk)\ **Replies:** 5\ **Last updated:** [July 13, 2020, 8:54am UTC](https://community.temporal.io/t/context-propagation-sample-not-working/154 "2020-07-13T08:54:59Z")
We use jwt for authentication which means that workflows and activities need to carry around jwt token of the function that triggers them. I tried adapting the sample to no avail. then tested the sample and it doesn’t w…