> For the complete documentation index, see [llms.txt](https://run-ai-docs.nvidia.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://run-ai-docs.nvidia.com/saas/infrastructure-setup/authentication/overview.md). # Authentication and Authorization NVIDIA Run:ai authentication and authorization enables a streamlined experience for the user with precise controls covering the data each user can see and the actions each user can perform in the NVIDIA Run:ai platform. Authentication verifies user identity during login, and authorization assigns the user with specific permissions according to the assigned [access rules](/saas/infrastructure-setup/authentication/accessrules.md). Authenticated access is required to use all aspects of the NVIDIA Run:ai interfaces, including the NVIDIA Run:ai platform, the NVIDIA Run:ai Command Line Interface (CLI) and APIs. ## Authentication There are multiple methods to authenticate and access NVIDIA Run:ai. ### Single Sign-On (SSO) NVIDIA Run:ai supports three methods to set up SSO: * [SAML](/saas/infrastructure-setup/authentication/sso/saml.md) * [OpenID Connect (OIDC)](/saas/infrastructure-setup/authentication/sso/openidconnect.md) * [OpenShift](/saas/infrastructure-setup/authentication/sso/openshift.md) When using SSO, it is highly recommended to manage at least one local user, as a breakglass account (an emergency account), in case access to SSO is not possible. ### Username and Password Username and password access can be used when SSO integration is not possible. ### Secret Key (for Application Programmatic Access) Secret is the authentication method for [Service accounts](/saas/infrastructure-setup/authentication/service-accounts.md). Service accounts use the NVIDIA Run:ai APIs to perform automated tasks including scripts and pipelines based on their assigned [access rules](/saas/infrastructure-setup/authentication/accessrules.md). ## Authorization The NVIDIA Run:ai platform uses Role Based Access Control (RBAC) to manage authorization. Once a user or service account is authenticated, they can perform actions according to their assigned access rules. ### Role Based Access Control (RBAC) in NVIDIA Run:ai While Kubernetes RBAC is limited to a single cluster, NVIDIA Run:ai expands the scope of Kubernetes RBAC, making it easy for administrators to manage access rules across multiple clusters. RBAC at NVIDIA Run:ai is configured using access rules. An access rule is the assignment of a [role](/saas/infrastructure-setup/authentication/roles.md) to a [subject in a scope](/saas/platform-management/aiinitiatives/adapting-ai-initiatives.md#scopes-in-an-organization): `` is a `` in a ``. * **Subject** * A user, group, or service account assigned with the role * **Role** * A set of permissions that can be assigned to subjects. NVIDIA Run:ai provides predefined roles that are system-defined and cannot be edited or deleted. Administrators can also create custom roles via the API to meet specific organizational requirements. * A permission is the actions (view, edit, create and delete) that the user can perform over a NVIDIA Run:ai entity (e.g. projects, workloads, users). For example, a role might allow a user to create and read Projects, but not update or delete them. For a reference of all available permissions, see [Permissions](/saas/infrastructure-setup/authentication/permissions.md) * **Scope** * A scope is part of an organization in which a set of permissions (roles) is effective. Scopes include Projects, Departments, Clusters, Account (all clusters). Below is an example of an access rule: **** is a **Department admin** in **Department: A** ![](https://3278325112-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLiY1aIqfxD3a58ufUYOM%2Fuploads%2Fgit-blob-a3f57b31c214d58a31d229abf3cb9d69ddc5f81b%2Fauth-rbac.png?alt=media) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://run-ai-docs.nvidia.com/saas/infrastructure-setup/authentication/overview.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.