Security¶
Settings has two pages called Security:
| Page | Where to find it | Who can use it | What it controls |
|---|---|---|---|
| Your account security | Settings → Security (or the account menu → Security) | Every signed-in member | Your password, multi-factor authentication (MFA) and login sessions |
| Organization security | Settings → Administration → Security | Members with the Manage organization capability | How people sign in to the organization: Require MFA, connection management, Sign-up domains and Enterprise SSO |
Setting up single sign-on?
Enterprise SSO setup, email domains, Require SSO and SSO provisioning have their own page: Enterprise SSO (SAML and OIDC).
Some behaviour depends on how your deployment handles sign-in. On this page, Keycloak deployments means self-managed deployments where people sign in through Keycloak. This is the default for self-managed deployments, and it is always the case on air-gapped deployments. Differences are called out in each section.
Your account security¶
The personal Security page ("Your sign-in methods, sessions, and recovery options.") applies to your own account only. It has up to three sections: Password, Multi-factor authentication and Login sessions. Which sections you see depends on how you sign in.
Availability
- Who can do this: every signed-in member, for their own account.
- Deployment: Actian SaaS and self-managed deployments. Some sections work differently on Keycloak deployments (see Keycloak deployments).
To open it, click your name at the bottom of the sidebar and choose Security, or go to Settings → Security.
Password¶
If you sign in with an email address and password, the Password section lets you change it:
- Click Send reset email.
- Check your inbox. AI Analyst sends a link to your primary email address ("Check your inbox for a password reset email.").
- Open the link and choose a new password on the sign-in page it opens.
You can't type a new password directly in Settings.
This section isn't shown if your account was created with Google, Microsoft or your organization's Enterprise SSO. It is also not shown on Keycloak deployments.
Info
If you normally sign in with Google or Microsoft, there is no password to manage here. If you also sign in with email and password using the same verified email address, both sign-in methods open the same account.
Multi-factor authentication¶
Multi-factor authentication (MFA) adds a second step when you sign in: after you enroll, sign-in asks for a code. MFA belongs to your account, so it applies in every organization you're a member of.
You can enroll two kinds of method:
| Method | How you get the code |
|---|---|
| Authenticator app | An app such as Google Authenticator, Microsoft Authenticator or Authy generates a six-digit code. |
| Email code | A code is sent to your primary email address. You can enroll one email method. |
Set up MFA¶
On Keycloak deployments, MFA is set up differently. See Keycloak deployments.
- In the Multi-factor authentication section, turn on Enable MFA.
- Choose Enroll authenticator app or Enroll email.
- For an authenticator app, scan the QR code with your app, or copy the Secret into it. For email, check your inbox for the code.
- Enter the six-digit code under Confirmation code and click Confirm. Confirm within 10 minutes of starting. If the code is wrong, you see "That code didn't work. Try again."
- When you enroll your first method, a Recovery code dialog opens. Copy the code, then click Done.
Enrolled methods are listed as Authenticator app or Email code. From then on, sign-in asks for a code.
Keep your recovery code safe
Copy your recovery code and store it somewhere secure, such as a password manager. It is shown only once. You can use it instead of a code when you sign in. If you lose it, click Regenerate recovery code to get a new one. This invalidates the old code.
Remove a method or turn off MFA¶
- To remove one method, click Remove next to it and confirm Remove this sign-in method?
- To turn off MFA completely, switch off Enable MFA and click Turn off in the Turn off multi-factor authentication? dialog. This removes all enrolled methods.
If your organization has turned on Require MFA, you're asked to enroll again the next time you sign in.
If you sign in with Enterprise SSO¶
On Actian SaaS, the Multi-factor authentication section isn't shown if you sign in through your organization's Enterprise SSO. Your company's identity provider handles MFA for you, and your organization's Require MFA setting doesn't apply to you.
Login sessions¶
Login sessions ("Devices that are signed in to your account.") lists every device where you are signed in. Each session shows:
- the operating system, for example macOS or Windows (or Unknown device when it can't be detected)
- the browser and version, for example Chrome 126
- the last IP address
- the date it was last used
Your current session is listed first and marked (this device).
To sign out a session you don't recognize or no longer use, click Revoke next to it. If you revoke (this device), you are signed out right away.
Note
If an administrator sets you to No access in an organization, all of your login sessions are revoked. Because sessions belong to your account, this signs you out everywhere, not just in that organization.
Keycloak deployments¶
On Keycloak deployments, your account security works differently:
- Password: the Password section isn't shown.
- MFA setup: you set up an authenticator app on the Keycloak sign-in page when Keycloak asks for it, not from Settings. The enrollment buttons in Settings (Enroll authenticator app, Enroll email and Regenerate recovery code) don't work on these deployments and show an error, so don't use them. Email codes and recovery codes aren't available.
- Removing MFA: removing your authenticator, or turning off Enable MFA, doesn't switch MFA off. Your next sign-in asks you to set up an authenticator app again.
- Enterprise SSO: the Multi-factor authentication section is shown even if you sign in through your organization's identity provider. On Members, SSO members show MFA on or MFA off, not MFA via IdP.
- Login sessions: sessions show Unknown device with no browser line. The IP address and last-used date are still shown.
Organization security¶
The organization Security page ("Manage how people sign in to this organization.") holds the sign-in policies for the whole organization.
Availability
- Who can do this: members with the Manage organization capability (for the organization). The Administrator preset includes it.
- Plan: the Enterprise SSO section appears only in plans that enable Enterprise SSO.
- Deployment: Actian SaaS and self-managed deployments. Sign-up domains appear only on Keycloak deployments.
To open it, go to Settings → Administration → Security.
The page has these sections, from top to bottom:
| Section | What it contains | When you see it |
|---|---|---|
| Authentication | Require MFA and Restrict connection management | Always |
| Sign-up domains | Email domains whose owners can create an account and join | Keycloak deployments only |
| Enterprise SSO | Your single sign-on connection, email domains, Require SSO, Provisioning and Danger zone | When your plan includes Enterprise SSO. See Enterprise SSO. |
Require MFA¶
When Require MFA is on, everyone who signs in to this organization with a password, Google or Microsoft must enroll MFA. People who already enrolled are already asked for a code. People who sign in through Enterprise SSO aren't affected, because their identity provider handles MFA.
To turn it on or off:
- Switch Require MFA on or off.
- Click Save in the bar at the bottom of the page. Click Discard to undo the change instead.
Note
Require MFA isn't available on Keycloak deployments. There, the setting can't be saved from this page.
Check who has MFA¶
Go to Settings → Administration → Members. The MFA column shows an icon for each member. Hover over or focus the icon to see its label:
| Icon | Label | Meaning |
|---|---|---|
| Green check | MFA on | The member has enrolled at least one MFA method. |
| Red cross | MFA off | The member hasn't enrolled MFA. |
| Blue check | MFA via IdP | The member signs in through Enterprise SSO, so their identity provider handles MFA. Not shown on Keycloak deployments, where SSO members show MFA on or MFA off. |
Restrict connection management¶
By default, any member with the Edit capability in a Workspace that a data connection is attached to can add, edit or delete that connection. When Restrict connection management is on, only members with the Manage organization capability (Administrators) can add, edit or delete data connections. Other members keep read access to connections.
This switch saves as soon as you change it. Each change is recorded in the organization's audit log.
Sign-up domains¶
On Keycloak deployments, Sign-up domains let colleagues join your organization on their own. Anyone who isn't already a member of an organization and has a verified email address on a listed domain can create an account and join the organization.
Availability
- Who can do this: members with the Manage organization capability (for the organization).
- Deployment: Keycloak deployments only. The section isn't shown on Actian SaaS.
Before you start¶
Email (SMTP) must be set up in Keycloak, because people have to verify their email address before they can join. Until it is, adding a domain shows "Set up email in Keycloak first. People must verify their address before they can join."
Add or remove a domain¶
- Go to Settings → Administration → Security.
- Under Sign-up domains, type the domain in Email domain (for example
acme.com) and click Add domain. A leading@is removed for you. - To stop accepting a domain, click Remove next to it.
Domains are trusted as you enter them. There is no DNS check. Matching is exact: acme.com doesn't cover mail.acme.com, so add each domain you need.
A domain is refused when:
- it isn't a valid domain name
- it belongs to a public email provider such as Gmail or Outlook
- it's a known disposable email domain or a shared hosting domain
- you've already added it, or another organization on the same deployment uses it
- Require SSO is on ("Turn off Require SSO first. Sign-up domains can't be used while it's on.")
If you see "Saved, but Keycloak registration hasn't been updated yet. It catches up on the next change or restart.", your change is saved and Keycloak is updated the next time a Sign-up domain changes or the server restarts.
What newcomers experience¶
While at least one Sign-up domain exists and Keycloak email is set up, the Keycloak sign-in page lets people register and asks them to verify their email address. If they don't already belong to an organization, and they verify an address on a listed domain and sign in:
- If an invitation is already waiting for them, they join with that invitation's capabilities.
- Otherwise, they join with the organization's Default preset.
People who register with an address on any other domain get an account but see Ask your administrator for access.
Seats¶
Nobody can join through a Sign-up domain while all Seats are taken. Open invitations and people waiting for their first sign-in count toward the limit. A refused newcomer sees "Your email domain lets you join an organization, but it has no free Seats right now. Ask an administrator to free one, then sign in again." They join the next time they sign in after a Seat frees up.
Keeping someone out¶
Removing a member doesn't keep them out: they can sign in again and rejoin, with no access. To lock someone out, set them to No access on Members, or disable their account in Keycloak.
Note
Sign-up domains and Require SSO can't be used together. Remove every Sign-up domain before you turn on Require SSO.
Your operator can also list Sign-up domains when they first install AI Analyst. After that, manage them on this page.
Enterprise SSO¶
When your plan includes Enterprise SSO, the Enterprise SSO section lets you connect your company's identity provider (for example Okta, Microsoft Entra ID or Cloudflare Access) over SAML or OIDC. Password, Google and Microsoft sign-in keep working until you turn on Require SSO.
- With no connection, the section shows a Not connected badge and a Set up SSO button that opens the setup wizard.
- With a connection, it shows the protocol, the identity provider, the verification status and Change provider details, followed by the Require SSO, Provisioning and Danger zone sections.
If you don't see this section, your plan doesn't include Enterprise SSO.
For the full setup and management guide, see Enterprise SSO (SAML and OIDC).