Users and access

Access to Kyvernon rests on users, roles and permissions. A user signs in with a password and a verification code, or through an identity provider. A role is a set of privileges. A permission gives a role to a user or a group on one object of the inventory.

Identity concepts explains how these parts decide what a user may do. Users and groups creates the accounts, and Roles and permissions gives them access. Sign-in security covers passwords, lockout and two-step verification, and Single sign-on connects an OpenID Connect provider. API tokens are for automation, and Sessions and audit lists active sessions and records every change.

• Identity conceptsUsers, groups, roles, privileges and permissions on objects, and how Kyvernon decides what a user may do.
• Users and groupsCreate local users and groups in the console, set their groups, disable them, lift a lockout and delete them.
• Roles and permissionsBuild custom roles from privileges, give a role to a user or group on an object, check who has access and remove a permission.
• Sign-in securityChange your password, set up two-step verification with recovery codes, set the password and lockout policy and lift a lockout.
• Single sign-onConnect an OpenID Connect identity provider in the console, give its groups roles and sign in with an organisation account.
• API tokensCreate an API token with a lifetime for automation, copy its secret once, and revoke tokens that are lost or no longer needed.
• Sessions and auditSee who is signed in and end sessions, read and filter the audit log, export it, and learn how long records are kept.
• Identity troubleshootingSymptoms of refused sign-ins, rejected codes, ended sessions, permission denied and failing automation, with cause and remedy.