IDP & Tenant Management

Prerequisites

• Active IDP user account in a tenant
• For tenant admin functions: your IDP user must have Tenant Administrator status
• For role management: role with roles.view / roles.create / roles.edit / roles.delete
• For assignment management: role with access_grants.view / access_grants.manage
• For IDP user/group viewing: role with idp.view
• For IDP user/group management: idp.manage plus tenant admin status

Logging in (IDP flow)

Cadres uses a two-phase login. First authenticate your identity, then select an account context. Users with access to a single account skip the selection step.

1. Navigate to the login page at your Cadres URL.
2. Enter your email address and password.
3. If MFA is enabled on your account, enter the 6-digit TOTP code from your authenticator app (Google Authenticator, Authy, etc.).
4. If you have access to one account: you are automatically logged in and redirected to the dashboard.
5. If you have access to multiple accounts: a selection screen appears. Choose the account you want to work in.
6. A session token scoped to the selected account is created. All subsequent actions are authorized within that account context.

Logging out

1. Click Logout from the user menu in the top-right corner.
2. Your token is immediately revoked across all server instances. Even in multi-instance deployments, logout takes effect instantly on every node -- there is no propagation delay.

Setting up MFA

TOTP-based multi-factor authentication. Once enabled, a 6-digit code is required on every login.

1. Navigate to Identity Center > My Profile.
2. Click Setup MFA. A QR code appears on screen.
3. Scan the QR code with your authenticator app (Google Authenticator, Authy, Microsoft Authenticator, etc.).
4. Enter the 6-digit verification code displayed in your authenticator app.
5. MFA is now active. You will be prompted for a code on every subsequent login.

Disabling MFA

1. Navigate to Identity Center > My Profile.
2. Click Disable MFA.
3. Enter your current password for confirmation.
4. MFA is removed from your account.

Enforcing tenant-wide MFA

1. Navigate to Identity Center > Security Settings (requires tenant admin).
2. Toggle MFA Required to on.
3. All users in the tenant must now enable MFA before they can log in.

Managing tenant users

Tenant admins can create, update, and deactivate user accounts. Requires idp.manage and tenant admin status.

1. Navigate to Identity Center > Users.
2. Create user: Click "Add User". Enter email, password (8-72 characters), and name. Optionally toggle tenant admin status.
3. Update user: Click a user row to edit name, phone number, active status, or admin status.
4. Reset password: Click "Reset Password" on the user row. Enter the new password (8-72 characters, bcrypt limit).
5. Delete user: Click "Delete" to deactivate the user. You cannot delete yourself or the last remaining admin.

Managing groups

Groups allow bulk role assignment. Add users to a group, then assign roles to the group -- all members inherit those permissions.

1. Navigate to Identity Center > Groups.
2. Create group: Click "Add Group". Enter a name and description.
3. Add members: Open the group detail page, search for users by email or name, and add them to the group.
4. Remove members: Click "Remove" next to a member's name in the group detail.
5. Grant account access: In group detail, click "Add Account Access" and select the target account and access level.
6. Grant org access: In group detail, click "Add Org Access" and select the organization and role.
7. Delete group: Click "Delete". This is a hard delete -- the group and all its memberships are permanently removed.

Configuring SAML SSO

Integrate with an external identity provider for single sign-on. Requires tenant admin status and idp.manage.

1. Navigate to Identity Center > SSO.
2. Enter your SAML Identity Provider details: Entity ID, SSO URL, and SLO URL (optional).
3. Paste the IdP's X.509 certificate.
4. Configure the attribute mapping JSON to map IdP attributes to SPOG fields (email, name, groups, etc.).
5. Toggle Enabled to activate SSO.
6. Click Save. Users can now authenticate via your external IdP.

Creating roles

Roles define what a user can do. Each role is a set of permission keys organized by domain. Roles can be scoped to the entire account or a specific organization.

1. Navigate to Access Control > Roles.
2. Click Create Role.
3. Enter a name and description.
4. Choose scope: Account (global -- applies to all orgs) or Organization (select a specific org).
5. Use the permission editor to toggle permission keys. Permissions are organized by category (Hosts, Alerts, Patches, etc.) with checkboxes for each key.
6. Optionally start from a built-in template to pre-populate permissions.
7. Click Save.

Built-in role templates

Managing role assignments

Assignments link roles to users or groups. Multiple roles can be stacked -- permissions are additively merged.

Creating an assignment

1. Navigate to Access Control > Role Assignments.
2. Click Add Assignment.
3. Search for a user (by email or name) or group (by name). Search is scoped to tenants linked to your account.
4. Select the role to assign.
5. Optionally set an expiration date for time-limited access (e.g. contractor engagement, temporary escalation).
6. Click Assign.

Removing an assignment

1. Navigate to Access Control > Role Assignments.
2. Find the assignment in the list.
3. Click Remove.

Auto-expiry

Assignments with an expiration date are automatically deactivated when they expire. A background scheduler checks every 30 minutes and proactively deactivates expired assignments. Expired assignments are also filtered out at query time -- no manual cleanup required.

Viewing your access

1. Navigate to Identity Center > My Access.
2. View all accounts and organizations you can access, along with the permissions granted.
3. Each permission source is labeled as direct (assigned to you personally) or group:{name} (inherited from a group membership).

Permission reference

Troubleshooting