authentication/authorization

13 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Temporal CLI works with Temporal Cloud

The Temporal CLI works with Temporal Cloud. The same commands used for local or self-hosted Temporal services, such as `temporal workflow start` and `temporal workflow list`, work with Temporal Cloud as allowed by your role once you provide an address and credentials.

Temporal Cloud extension for administrative tasks

The Temporal Cloud extension adds `temporal cloud` commands for managing Temporal Cloud account resources, including Namespaces, users, API keys, and Nexus endpoints. It must be installed separately from the base CLI.

Temporal Cloud uses role-based access control (RBAC)

Access to Temporal Cloud is governed by role-based access control (RBAC). Your ability to perform actions, including running CLI commands against Temporal Cloud, is determined by the roles and permissions you have been assigned.

Temporal Cloud extension capabilities for administration

The Temporal Cloud extension enables you to: create, configure, and delete Namespaces; create and manage API keys for programmatic access; invite users, assign roles, and manage user groups; create and configure Nexus endpoints; and view account information and manage connectivity rules.

Custom roles enable fine-grained authorization

Custom roles enable fine-grained authorization by binding sets of permissions (resource + actions) to a named role that can be assigned to users, user groups, and service accounts.

Authorizer Plugin

The Authorizer plugin contains a single Authorize method, which is invoked for each incoming API call. Authorize receives information about the API call, along with the role and permission claims of the caller.

Temporal Cloud Skill for AI agents

The Temporal Cloud Skill helps AI coding agents troubleshoot Temporal Cloud connectivity, authentication, and configuration issues. It is available at https://github.com/temporalio/skill-temporal-cloud.

Authorization section structure

The authorization section configures the Temporal Service's authentication and contains two structural subsections: jwtKeyProvider (supplies signing keys for verifying inbound JWTs) and remoteClusterAuth (controls bearer tokens for outbound cross-cluster RPCs). Top-level fields select and tune inbound plugins: authorizer (selects inbound authorizer, empty string disables, 'default' enables built-in role-based authorizer, case-insensitive), claimMapper (selects ClaimMapper extracting roles from verified token, empty string disables, 'default' enables built-in JWT ClaimMapper), audience (required aud claim value for inbound JWTs, validation skipped if empty), and authHeaderName (gRPC metadata header for bearer token, default 'authorization').

JWT key provider configuration

The jwtKeyProvider section configures the source of signing keys used by the default ClaimMapper to verify inbound JWTs with: keySourceURIs (list of strings, URLs to fetch JWKS-formatted public keys from, union of keys cached), and refreshInterval (Go duration string like '1m' or '5m', default 0, how often the key set is refetched, zero disables periodic refresh).

Remote cluster auth configuration

The remoteClusterAuth section controls outbound bearer tokens on cross-cluster RPCs and has no effect unless a TokenProvider is also configured via temporal.WithTokenProvider. It contains require (boolean, default false, when true every outbound cross-cluster RPC must carry a non-empty token returning Unauthenticated rather than sending empty authorization header; Temporal Service refuses to start when require is true but no TokenProvider is configured).

WithAuthorizer server option

WithAuthorizer sets a low level authorization mechanism that determines whether to allow or deny inbound API calls.

WithClaimMapper server option

WithClaimMapper configures a mechanism to map roles to Claims for authorization. It accepts a function that takes a config.Config and returns an authorization.ClaimMapper.

WithTokenProvider server option

WithTokenProvider configures a TokenProvider that supplies bearer tokens for outbound cross-cluster RPCs. TokenProvider is defined in the go.temporal.io/server/common/rpc/auth package.

Give your agent this brain