> ## Documentation Index > Fetch the complete documentation index at: https://rasa.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Users and Roles Setup Guide > Learn how to set up Studio users with Keycloak and manage their permissions Studio uses [Keycloak](https://www.keycloak.org/) to manage user authentication, roles, and permissions. This guide explains how to set up user roles for your team, including two main authentication options: 1. **[Simple Authentication](/docs/studio/installation/setup-guides/authorization-guide#simple-authentication-setup)**: Users log in with a username and password. 2. **[Single Sign On](/docs/studio/installation/setup-guides/authorization-guide#sso-setup)**: Centralized login using an identity provider. ## Roles Overview Studio includes eight default roles to tailor access levels to your team's needs. You can choose which ones make the most sense for your team and organization: * **SuperUser**: Oversees all of Studio’s functionality — from configuring settings to building the assistant and reviewing conversations. * **Lead Annotator**: Oversees and reviews annotations, manages CMS content. * **Annotator**: Annotates data and creates NLU annotations. * **Flow Builder**: Designs conversational flows and manages NLU data. * **NLU Editor**: Creates and edits NLU models for training. * **Business User**: Tests assistants and interacts with flows for business insights. * **Developer**: Handles technical tasks like exporting annotations and configuring settings. * **Conversation Analyst**: Analyzes conversation data and manages tags. * **Conversation Viewer**: Views conversation data and tags. *** ## Simple Authentication Setup Follow these steps to set up users with username/password login: 1. **Log in to Keycloak**: Navigate to `https:///auth` and log in using admin credentials (`KEYCLOAK_ADMIN_USERNAME` and `KEYCLOAK_ADMIN_PASSWORD`). Admin Console

2. **Select the Realm**: Choose the `rasa-studio` realm from the dropdown menu. Realm Selection

3. **Add a New User**: * Navigate to `Users` > `Add user`. * Enter user details and click **Create**.

4. **Assign Roles**: * Go to the `Groups` tab and add the user to the relevant groups to assign roles. Assign Groups

5. **Set the Password**: * Go to `Credentials` and set a password. * Enable the "Temporary password" toggle if the user needs to reset their password on first login. Set Password

## SSO Setup To configure SSO for your users: 1. **Log in to Keycloak**: Access the `Administration Console` and select the `rasa-studio` realm. 2. **Configure Identity Providers**: * Navigate to the `Identity Providers` section. * Select and configure your desired provider (e.g., Google, Azure AD).

3. **Follow Provider Instructions**: Refer to [Keycloak SSO Documentation](https://www.keycloak.org/docs/latest/server_admin/#sso-protocols) for specific setup steps. You can read more details on authorization in our [API Authorization Guide](/docs/studio/security/authorization) or [Managing Users Guide](/docs/studio/security/managing-users). ## Related topics - [Setup](/docs/learn/deployment/gcp/gcp-playbook-setup.md) - [Rasa Pro Version Migration Guide](/docs/reference/changelogs/rasa-pro-migration-guide.md) - [Local Setup for Custom Actions](/docs/studio/build/actions/local-testing.md)