Installation overview
SES is delivered as a set of Docker containers, managed and deployed with Ansible. This guide walks you from a bare server to a running, multi-institute platform.
What you will install
Core concepts
| Concept | Meaning |
|---|---|
| Institute (tenant) | One isolated customer, with its own PostgreSQL schema and its own URL path /<slug>/.... |
| EMS environment | The exam-management system an exam belongs to (built-in SES or an external one such as Moodle, ANS, Remindo). |
| Safe Exam Browser (SEB) | The lockdown browser students must use to take exams. |
| Identity provider | The OIDC/SSO source that authenticates users. By default SES ships with Keycloak (dev/test), but each institute can connect its own identity provider, e.g. Microsoft Entra ID (Azure AD), Google, Auth0 or SURFconext. See Keycloak SSO → integrating other OIDC providers. |
Installing in a nutshell
- A server that meets the server requirements.
- Secrets generated into
.env.secrets(see environment and secrets). - The Ansible playbook run against the host (see deployment).
- Keycloak realm and roles configured (see Keycloak SSO).
- Tenants created with
add_tenant(see deployment → tenant management).
Plan the order
The single most important decision is the URL scheme for institutes. Every
tenant gets a path prefix such as https://domain/institute-slug/, so choose
your institute slugs before deploying.
Who works with the platform
| Role | Typical access |
|---|---|
| Superuser | Everything, cross-institute operations |
| Institute admin | Staff tools, exams, SEB, users |
| Teacher | Own faculty's exams, grading |
| Student | Only taking exams |