> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cyberup24.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Identity and Access Management for the LARK Appliance

Access to the LARK is managed centrally through Keycloak, which provides single sign-on across all of the appliance's applications. Every application routes its authentication through Keycloak, so operators authenticate once and then reach the applications their role permits.

## Access model

<Columns cols={2}>
  <Card title="Single sign-on" icon="right-to-bracket">
    Rather than each application maintaining its own logins, Keycloak authenticates operators once and grants access to the applications they are permitted to use.
  </Card>

  <Card title="Role-based access" icon="user-shield">
    Access is determined by the role assigned to an account, so analysts and administrators receive the access appropriate to their function.
  </Card>
</Columns>

## Administrator credentials

An administrator account is provided with each appliance. These credentials are delivered with the appliance and are not included in this documentation. The administrator uses them to sign in and to create accounts for other operators.

<Note>
  Creating operators, assigning roles, and removing access are administrative tasks covered on the user management page. This page describes only how identity and access operate at a high level.
</Note>