AsterionDocumentation v0.4.1

Tenants, users and roles

Multi-tenancy, the five roles, products per tenant, sign-in with password, TOTP or OIDC.

Roles

RoleScopeCan
Viewertenantsee everything of the tenant
Editortenantadd and edit targets, hosts, groups, plans, domains; run checks; set host locations
Admintenantadditionally: products (Features), notification channels, reports, exposure policy, tenant satellites, members
Operatorglobaladmin in every tenant; edits every tenant’s parameters; creates satellites for any tenant or globally
Super adminglobaladditionally users and System settings

A user has one role per tenant and switches between tenants in the top bar. The two global roles are flags on the user (or come from OIDC groups).

Products per tenant

Features (tenant admins, operators): switch Host, DNS and Mail monitoring on or off, and set the intervals of the automatic port scan and its follow-up checks (hourly, every 6 or 12 hours, daily, weekly; default daily).

Features of a tenant: products and the intervals of the automatic scans.
Features of a tenant: products and the intervals of the automatic scans.

Sign-in

  • Password with optional TOTP (authenticator app) and recovery codes. Super admins can require TOTP for all local users.
  • OIDC (Microsoft Entra ID, Keycloak, any compliant provider) with PKCE. Users are created on first login (OIDC_AUTO_CREATE_USERS) in OIDC_DEFAULT_TENANT with OIDC_DEFAULT_ROLE. Members of OIDC_ADMIN_GROUP become super admins, of OIDC_OPERATOR_GROUP operators. OIDC_DISABLE_LOCAL_LOGIN hides the password form.
  • Login, TOTP and password reset are rate limited.

My account

Users change their name, language, password and TOTP, and download their data as JSON (GDPR Art. 15/20). Accounts are deleted by an administrator.