4.6 KiB
id, title, sidebar_label
| id | title | sidebar_label |
|---|---|---|
| settings | Settings | Settings |
One page, three groups: Access, Monitoring and Integrations. Your licence has its own page.
Settings need the owner or admin role.
Access
People
Add, remove and re-role the people who can sign in.
| Role | Can |
|---|---|
owner |
Everything |
admin |
Everything except owner-only settings |
member |
Servers, keys, workflows, monitors, secrets, console |
Local members sign in with an email address and a password.
People managed by Vantage HQ
On a cloud instance, anyone granted access from the Vantage HQ portal appears here as a read-only row with a link back to the portal.
:::warning You cannot edit those people here Their role, password and access are owned by Vantage HQ, so changing or removing them has to be done there. See People and roles. :::
Single sign-on
:::info Requires the single sign-on feature on your licence It is a per-instance feature you enable on a paid plan. :::
Add as many identity providers as you need. Each has its own name, its own button on the login page and its own callback URL.
If you configured single sign-on on an older version, see Upgrading.
Start from a preset:
| Preset | You provide |
|---|---|
| Microsoft Entra ID | Directory (tenant) ID |
| Google Workspace | Nothing further |
| Okta | Your Okta org domain |
| GitHub | Client ID and client secret only |
| Other (OpenID Connect) | The issuer URL of your provider |
Every provider also needs a Client ID and Client secret. The secret is stored encrypted and is never shown again after you save it.
:::info GitHub needs a verified primary email Vantage identifies people by email address, and it only accepts a GitHub address that is both the account's primary address and confirmed by GitHub. :::
Callback URL
Each provider's card shows its callback URL with a copy button. That is the address you register with the identity provider when you set up the application on their side. Register each provider separately, even where several use the same identity provider.
Turning off password sign-in
Once at least one provider is enabled you can turn off email and password sign-in. Vantage refuses any change that would leave nobody able to sign in, whether that is switching off passwords or disabling your last provider. Keep one route open until everyone who needs access can use the new one.
Require MFA
Owners can require a second sign-in factor for everyone signing in with a password. See Multi-factor authentication for what this does, how members enrol, and how to reset a locked-out member.
Monitoring
- Offline threshold, how long a server may go unheard from before it is marked offline. The default is 5 minutes.
- Offline alerts, the notification channels to tell when that happens.
- Notification channels have their own page.
- Workflow log retention, how long run logs are kept.
| Value | Meaning |
|---|---|
| unset | 30 days |
| a number | that many days |
0 |
keep forever |
Integrations
External Secrets Operator token
The token Kubernetes uses to read your secret groups. It is shown once, stored only as a fingerprint, and can be replaced at any time. See Secrets.
Licence
The Licence page, in the sidebar, shows your instance ID, whether you are cloud or self-hosted, your tier, server allowance, enabled features and expiry date.
On a self-hosted install you paste your licence here. This works even while your current licence has expired, which is how you get an instance out of read-only mode.
On a cloud instance there is nothing to paste. Licences are installed for you, and the page links to the portal instead.
See Licensing and entitlements.
Sessions
Signing in gives you a session that lasts 24 hours. There is no session list to manage. On a self-hosted install, restarting Redis signs everyone out and affects nothing else.