Users, MFA, SSO & keys

Choose roles

• Administrators manage infrastructure, trust, users and credentials.
• Operators preview and queue patches and refresh repositories.
• Viewers inspect monitoring and read permitted records.

The API enforces permissions independently of navigation visibility. Each user changes their password through Account with current-password confirmation.

Enable MFA and SSO

Account provides TOTP enrollment and session revocation. The sign-in screen explains forced sign-outs after password changes, session revocation, MFA enrollment or expiration. Configure OIDC_ISSUER, OIDC_CLIENT_ID and OIDC_CLIENT_SECRET, register PUBLIC_URL/auth/sso/callback and bind the provider’s immutable issuer/subject pair to an existing account. Preserve the exact issuer, including a trailing slash. Use identity-provider MFA for SSO logins.

Rotate target keys

SSH-key rotation verifies the replacement before removing the previous key, with a resumable journal. Agent-health recovery permits a narrow resume when the only drift is the managed authorized_keys entry and an unfinished journal matches. A newly downloaded enrollment installer contains the current identity.

Recover an administrator

./reset-admin-password.sh
# Another existing administrator:
./reset-admin-password.sh --username alice

Run from the trusted deployment directory. The prompt accepts a new password without echoing it and revokes existing sessions. Explicit --reset-mfa and --enable options support account recovery when required.