> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ibex.ajna.cloud/llms.txt
> Use this file to discover all available pages before exploring further.

# Ibex Identity Service

> Core authentication and authorization handling via JWT validation.

# Ibex Identity Service

The `ibex-identity-service` is the sole gatekeeper for all interactive sessions on the data platform. It handles user authentication, issues tokens, and provides real-time validation for internal services.

## Architectural Role

This FastAPI-based Python service listens on port `8090` and is exposed via Traefik to the outside world purely on the `/auth/*` and `/users/*` routes. Every other service on the platform implicitly trusts the JWTs generated here.

## High-Level Working

### Multi-Mode Authentication

The identity service relies on an environment flag (`IDENTITY_AUTH_MODE`) to switch internal behaviours seamlessly:

* **Local Mode**: Uses a persistent SQLite volume (`/data/ajna-identity.db`) to store usernames, enforce passwords, and manage sessions locally during development and staging.
* **Cognito Mode**: Delegates physical authentication validation to AWS Cognito (via `User Pool ID` and `Client ID`).

### The Validator Endpoint

Almost all internal secured APIs (like the `ibex-bi-backend`) run an explicit check against this service. They intercept incoming requests, capture the Bearer Token, and proxy a `GET /validate` check.

* If it returns `200 OK`, the internal backend completes the user's report query.
* If it returns `401 Unauthorized`, the backend rejects the request instantly.