Console accounts, roles and secure sign-in — second factor, SSO, LDAP and SCIM

What it is for

Accounts sign in to the console with a role. The role decides what the account may do. Every account can secure its sign-in with a second factor — a code from an authenticator app. On your own relay you can also connect the sign-in to your company sign-in: OIDC (for example Entra ID or Keycloak), LDAP / Active Directory or SCIM.

What you need

• Cloud: you are the administrator of your access. Every access has one administrator; further ones only with a Cloud licence, not in Free.
• Own relay: an account with the Administrator role and no restriction to accesses (system administrator).
• For the second factor an authenticator app, for example Microsoft Authenticator, Google Authenticator or Aegis.
• For OIDC, LDAP and SCIM: your own relay and access to your identity provider or directory.

How to do it

The roles

In the console an access is called a tenant, and its administrator a tenant administrator.

Create further administrators of an access

1. Tenants → double-click the access (Edit tenant) → tab Administrators.
2. Enter a user name and a start password (at least 8 characters), click Create administrator.
3. Administrators sign in on the address of their access.

Create accounts with other roles (system administrator)

1. Open Users in the sidebar. The page is called Users & roles.
2. At the top enter user name, password and role, click Create / Change.
3. If the account should only see certain accesses: in the row menu (⋮) choose Assign tenants… and tick the accesses. Without a selection the account sees all of them.

On browserdesk.de only the operator creates such accounts. If you need technician or read-only accounts there, write to info@browserdesk.de.

Second factor for your own account

1. Click your account circle at the top right → Second factor → Set up.
2. Scan the QR code with the authenticator app. If that does not work, type the key shown below it by hand.
3. Enter the six-digit code from the app and confirm. The first correct code turns the second factor on.

From now on, after the password the sign-in also asks for the Code from the authenticator app. This also applies when you sign in with this account in the program. You turn it off in the same dialog, only with a valid code.

Phone lost: reset the second factor

A system administrator opens Users & roles. The column Second factor shows “active” for the account. In the row menu (⋮) choose Reset second factor and confirm. After that the password is enough again, and the account sets up the second factor anew.

Company sign-in (own relay only)

You set up all three ways under Settings → Configuration (B3).

• OIDC (section Sign-in via SSO (OIDC)): enter Authority (issuer), Client ID, Client secret and the Redirect URI — the redirect URI is https://<your-relay>/admin/api/auth/oidc/callback and must be registered exactly like that at the provider. Role mapping decides which role an account gets. The sign-in page then shows Sign in with SSO.
• LDAP / Active Directory (section Sign-in via LDAP / Active Directory): server (the name as in the certificate), LDAPS port 636, either a service account with search base and user filter, or just a bind template such as {benutzer}@company.local. Group → role maps groups to roles. Sign-in uses the normal sign-in form.
• SCIM (section Provisioning via SCIM): Enable SCIM. Then in Users & roles → API tokens … create a token with the purpose SCIM provisioning and copy it — it is shown only once. In the identity provider enter the address https://<your-relay>/scim/v2 and this token. The provider then creates accounts, changes roles and disables them; sign-in still happens via OIDC or LDAP.

How you know it worked

• The new account is listed in Users & roles; the column Origin shows Local, LDAP or SCIM.
• With a second factor the column Second factor shows “active”, and the sign-in asks for the code.
• An account disabled via SCIM shows “SCIM · disabled”.

Good to know

• The emergency sign-in (without user name, with the relay's admin password) has no second factor. Work with named accounts and give the emergency sign-in a long password (B9).
• The second factor is voluntary. A requirement for console accounts and recovery codes do not exist yet. For members of an access there is a requirement (B5).
• A code works only once. If you sign in twice within 30 seconds, wait for the next code.
• Turning the second factor on signs your account out in the program; the program asks again, with a code.
• OIDC and SCIM accounts bring their second factor from the identity provider. LDAP accounts use the console's second factor.
• Disabling via SCIM immediately ends all console sessions of the account. Via SCIM the relay grants at most the role set in Highest role via SCIM (default Supervisor).
• LDAP only works encrypted (LDAPS). Nested groups are not evaluated. A Linux or Docker relay needs the libldap2 library for it; the Docker image has it.
• Forgot your password: a system administrator or another administrator of the access sets a new one. There is no reset by email. If you are the only administrator of an access on browserdesk.de, write to info@browserdesk.de.
• Restrict console access to certain networks: B7.

If it does not work