Titan¶
Titan is Orion's user and group management service. It is the source of truth for who can access Orion, which workspaces and services they can use, and the user and group identities their workloads run as. Titan runs alongside Genesis as part of Orion Admin, and admins manage it from the User Management page.
How Titan Works¶
Your identity provider (Google, AWS Cognito, Microsoft Entra, or AD/LDAP) proves who a user is. Titan decides what that user can do. When a user signs in, Orion matches them to their Titan user by email, and their Titan group memberships determine their access.
Emails must match
A user's email in your identity provider must match their email in Titan, or they will not be authorized. See our authentication setup guide for details.
Users¶
Each Titan user has a username, email, and UID. Users can be added in several ways:
| Method | Description |
|---|---|
| Create manually | Add a user from the User Management page. |
| Sync LDAP users | Pull users in from your configured LDAP server. See Sync LDAP Users. |
| Import CSV/JSON | Bulk import users from a file. See Import Users. |
| API | Create users programmatically. See the User Sync example. |
Groups¶
Group membership is how Titan grants access. Some groups are created by you, and others are created automatically by Orion.
| Group Type | Description |
|---|---|
| Role | User defined roles; no UID. Includes the built-in admin and titan roles. |
| Posix | Allows users to have file/directory ownership. |
| Service | Created programmatically when a service is enabled; membership grants access to that service. |
| Workspace | Created programmatically during workspace creation; membership grants access to that workspace. |
Members of the admin and titan roles can manage users and groups. See our
User Management documentation for creating, importing, and assigning groups.
Workload Identity¶
When a workload launches, Titan's users and groups are loaded into it, so every workload runs as the user's own UID and group memberships. This keeps file and directory ownership consistent across workloads and shared storage.
Cluster Owner¶
On startup, Titan can create the cluster owner user and add them to the admin group. This is set from titan.owner,
titan.email, and titan.uid in the Genesis deployment values, and is optional.
API¶
Titan exposes user, group, and state endpoints under /titan. Calling them requires a user in the admin or
titan role. See our API Getting Started guide and the
User Sync example.