How it works
The console can act as an OpenID Connect client of Fluence Account, FluenceSecurity's identity provider. When configured, the sign-in page offers Sign in with Fluence Account next to the password form. The password form stays available for the bootstrap administrator.
The identity provider authenticates; the console authorizes. A person gets in only when their email already has a console account or matches the bootstrap administrator's email. Roles and organization grants always come from the console account, never from the identity provider.
Console sessions stay in step with the identity provider: revoking a session there signs the analyst out of the console on their next request, and signing out of the console ends the identity provider session as well.
Configure
- Register the console with Fluence Account. The redirect URI is
https://<console host>/api/auth/callbackand the post-logout URI ishttps://<console host>/. Both are compared as exact strings. - Put the issuer, client ID and client secret in the environment file under the single sign-on group.
- Apply the change:
docker compose up -d. - Check
curl -sI https://<console host>/api/auth/startanswers with a redirect to the issuer. A503means one of the three values is empty.
Sessions and re-authentication
Console sessions expire after 12 hours of activity and can be renewed up to 24 hours from sign-in; portal sessions are shorter. A banner warns before expiry and offers to stay signed in. Session limits are shown in Settings › System.
Customer sign-in
Customer accounts in the portal sign in with a password and a mandatory authenticator app. See Portal security.