> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cyberup24.com/llms.txt
> Use this file to discover all available pages before exploring further.

# User Management

User access is managed centrally through Keycloak. Because every application authenticates through Keycloak, managing a user in one place controls that user's access throughout the appliance.

## Access structure

Several Keycloak concepts govern user management:

* **Realm.** The realm is the security boundary that holds the appliance's users, credentials, roles, and groups. Each appliance has its own realm, and its name is provided with the appliance. The correct realm must be confirmed before changes are made.
* **Roles.** Roles are the permissions used for access control. The appliance ships with its roles created and assigned. These roles must not be altered.
* **Groups.** Groups assign roles to users. Adding a user to a group grants that group's access, so grouping is the mechanism for setting what a user can do.

The appliance is delivered with two preconfigured groups:

<Columns cols={2}>
  <Card title="Analysts" icon="user">
    Access to the analysis and investigation tools and the ability to view and query collected data. Analysts do not hold system configuration or administrative privileges.
  </Card>

  <Card title="Administrators" icon="user-gear">
    Full access to all applications, including application management in Rancher, system configuration, and user management in Keycloak.
  </Card>
</Columns>

<Note>
  In normal operation, the only user-management actions required are creating users and assigning them to the Analyst or Administrator group. The roles behind those groups are already configured.
</Note>

## Adding a user

<Steps>
  <Step title="Open the Keycloak Admin Console">
    Open Keycloak in a web browser and sign in with an account authorized to manage users. Confirm the correct realm for the appliance is selected.
  </Step>

  <Step title="Create the account">
    Navigate to **Users** and select **Add user**. Enter a unique username. First and last name are optional and used for display only. Do not configure email-based verification or rely on email for activation or recovery. Save the account.
  </Step>

  <Step title="Set an initial password">
    Open the user's **Credentials** section and set an initial password. Mark it as **temporary** so the user is required to change it at first sign-in.
  </Step>

  <Step title="Assign a group">
    Open the user's **Groups** tab and add the user to the appropriate group (Analyst or Administrator). Save, and confirm the expected access appears for the user.
  </Step>

  <Step title="Confirm first sign-in">
    The user signs in and is prompted to set a new password before reaching any application, after which the same credentials apply across all applications.
  </Step>
</Steps>

## Offboarding a user

A user is offboarded as soon as access is no longer required. The preferred action is to **disable** the account rather than delete it: this immediately blocks sign-in while preserving the account record for audit and review.

<Steps>
  <Step title="Open the Keycloak Admin Console">
    Sign in with an administrative account and confirm the correct realm is selected.
  </Step>

  <Step title="Locate the user">
    Navigate to **Users**, search for the account, and open it. Confirm it is the correct account before making changes.
  </Step>

  <Step title="Disable the account">
    Set the account to disabled using the **Enabled** toggle. This prevents future sign-ins and is the standard offboarding action.
  </Step>

  <Step title="End active sessions">
    Terminate the user's active sessions so the user is signed out of any currently authenticated applications. Keycloak can log the user out across all connected applications.
  </Step>

  <Step title="Review access">
    Review the user's assigned access and remove anything no longer appropriate. Save, and confirm the account is disabled.
  </Step>
</Steps>

<Note>
  Disabling is the recommended default, as it blocks access without permanently removing the record. Permanent deletion may be appropriate in certain cases, subject to the operating organization's retention and audit requirements.
</Note>