The Configuration Service uses your organization's identity provider (OIDC) for sign-in. Which provider depends on how VAM was installed:

  • Bundled Keycloak: the installer deployed a Keycloak instance for you. Use the admin credentials shown on the installer's Finish screen for the first sign-in.
  • External OIDC: Microsoft Entra ID (Azure AD), Okta, Auth0, or your own Keycloak. Use the same credentials you would for any other application connected to that provider.

First Sign-in

  1. Open https://<your-vam-host>/config in a browser.
  2. Click Sign in.
  3. You are redirected to your identity provider's sign-in page.
  4. Enter your credentials.
  5. After successful sign-in you are redirected back to the Configuration Service and land on the Packages view.

Change the Bundled Keycloak Admin Password

Sign-in is handled by your identity provider, so passwords are changed there, not in the Configuration Service. If you used the bundled Keycloak, change the initial admin password immediately in the Keycloak account/admin console (its URL is shown on the installer's Finish screen).

Adding Users

How you add users depends on your identity provider.

Bundled Keycloak

  1. Open the bundled Keycloak admin console (its URL is shown on the installer's Finish screen).
  2. Sign in with the admin user.
  3. Navigate to Users → Add user.
  4. Fill in the user details, save and set a password under Credentials.
  5. Assign roles under Role mapping — assign vam-admin to grant Configuration Service access (the Configuration Service requires this exact role).

The user can now sign in to the Configuration Service.

External OIDC

User management happens entirely in your existing identity provider — Azure AD, Okta, etc. The only VAM-specific step is to ensure users are assigned to the application (or to the right group) in your provider's console, with the roles VAM expects. For Microsoft Entra ID the vam role is mandatory — without it a user authenticates but cannot use VAM. See the Identity Provider Setup guide for the full role list and how to assign it.

Roles

The Configuration Service authorizes on a single role:

Role

Permissions

vam-admin

Full access to the Configuration Service: install / upgrade / uninstall packages, change platform settings, take and restore backups and view cluster health. The service requires this exact role on every request — a user without it can sign in but cannot use the Configuration Service (there is no read-only tier).

If your identity provider uses groups instead of roles, map those groups to the roles VAM expects in your identity provider (VAM reads the roles and groups from the OIDC token; there is no separate role-mapping screen in the Configuration Service).

Signing Out

Use the account menu (the avatar in the top-right) and choose Sign out. You are returned to the sign-in page. Depending on your identity provider's settings, your session at the provider itself may remain — sign out there too if you are on a shared computer.

Trouble Signing in

See Troubleshooting → Cannot sign in. For external-provider problems (redirect-URI mismatch, missing roles, expired secret, storage access denied), see Installer troubleshooting → Sign-in and authorization.