Sign-In, Roles and Accounts
Control who can sign in to the guardian console, and use four roles to decide what each person can do there.
- Who
- Admins manage accounts, and everyone signs in
- Where
- Console → Accounts
Sign-In Modes
The guardian's identity service runs in one of two sign-in modes. You choose the mode when you deploy the guardian. See Compliance Profiles.
| Mode | Who holds the accounts | For |
|---|---|---|
| Standalone, the default | The guardian. Every account needs a one-time code, and admins manage accounts in the console. | Sites with no identity provider of their own, and air-gapped deployments |
| Brokered | Your organisation's identity provider. The guardian never holds a password. | Organisations that already have sign-on in place |
Before anyone signs in, the identity service shows the compliance profile's system-use notice, which states the conditions for using the system. The sign-in form appears only after the person confirms that they have read the notice and consent to it.
The notice appears before sign-in to the console and to the identity service's own administration pages. In brokered mode, it also appears before sign-in through your identity provider. All three compliance profiles show the notice, each with its own wording. A person whose session is already open is not asked again.
First Sign-In
On a standalone deployment, a new user first signs in with the temporary password an admin gave them. They set up the rest of the account during that first sign-in.
Open the guardian's address in a browser and choose Sign in. The console sends you to the identity service, which asks for your password and one-time code. The console never sees your password.
Guardian console — Sign inVeilNet GuardianWelcome backSign in to guardian.example.govSign inThe identity service asks for the username, password and one-time code on the next page. This console never sees the password.Authorised use only. Sign-ins and actions on this console are logged and audited by the operator of this deployment.
Roles
The guardian has four roles. Each role can do everything that the role below it can do. Give each person one role.
| Admin | Manager | Auditor | User | |
|---|---|---|---|---|
| Read the deployment, realms, machines, telemetry and the blocks in force | ✓ | ✓ | ✓ | ✓ |
| Read the renewal record, flow records, the Accounts page and the control activity | ✓ | ✓ | ✓ | — |
| Commission machines, download a manifest again, and revoke | ✓ | ✓ | — | — |
| Set the networks a machine serves | ✓ | ✓ | — | — |
| Issue a control credential for Networks, with console control off | ✓ | ✓ | — | — |
| Block and unblock machines, and read and move their compartments | ✓ | — | — | — |
| Issue a control credential for Block or Compartments, with console control off | ✓ | — | — | — |
| Mint, rename and archive sub-realms, and manage accounts | ✓ | — | — | — |
Each role suits a different job:
- Admin shapes the realm tree and decides who can sign in. Give it to people who may shut a machine out of its realm, or change which machines it can exchange data with.
- Manager runs the fleet. A manager commissions any machine, bootstrap node or member, and revokes machines. Give it to people who may change what your gateways serve.
- Auditor can read everything but change nothing. Auditors review the control activity, the renewal record and the Accounts page.
- User deploys machines with the manifests they are given. A user can read the fleet's telemetry but not its flow records.
No role can change the deployment's settings in the console. To change a setting, edit it on the guardian host and run setup again.
The guardian records every control action, with the person who took it and the address they took it from. See Control Activity.
A person who can sign in but has no role sees only the four roles, and nothing of the fleet, until an admin grants them one.
Accounts
On a standalone deployment, admins manage accounts on the console's Accounts page. Setup creates the first admin account, and admins create every later one there. Auditors and above can read the page as an access review.
Open Accounts. The page lists every account with its role and state, and shows the activity log below. To change an account, use the menu on its row.
Guardian console — AccountsNorthern Commandtier2 · au-ismPlatformDashboardRealmsNodes2RenewalsTelemetryRealmsguardian realm3office14field11lab9DeploymentAccountsStack & complianceSettingsGuardianAccountsguardian-adminAccountsThe people who may sign in to this console, and their roles. Kept in the identity service, changed here by admins.+ Create accountPeople5 accountsa.morganyouAlex Morgan · a.morgan@agency.govActivebreak-glassBreak GlassProtectedholds an administration role in the identity servicej.okaforJordan Okafor · j.okafor@agency.govActive⋯Change role…Reset password…Sign out everywhereDisable…Delete…r.chenRiley ChenDisabled⋯s.patelSam Patel · s.patel@agency.govNot signed in yet⋯Activitywhat admins changed here · newest first7 Oct 14:02a.morgan created s.patelguardian-auditor6 Oct 09:41a.morgan disabled r.chen—3 Sep 11:15a.morgan changed the role of j.okaforguardian-user → guardian-manager
An admin can also reset an account's password or sign the account out everywhere. Disabling, resetting and deleting an account all end its sessions at once.
Some accounts cannot be changed:
- You cannot change your own account.
- The last enabled admin cannot be demoted, disabled or deleted.
- An account that holds access the guardian did not grant is marked as protected, and the console does not change it.
The guardian records every account change, with the time, the admin, the account, the role before and after, and the source address.