DOC 05WORKSPACES AND INTEGRATION
Accounts and sign-in
LEVIATHAN can identify who is using the application. Accounts are kept by the local simulation service, and an installation decides whether signing in is off, optional or required.
Sign-in modes
| Mode | Behaviour |
|---|---|
| Off | No account layer; the application opens directly |
| Optional | The default. Users may sign in or choose Continue without an account; every feature works either way |
| Required | The simulation service refuses its endpoints until the caller is signed in, and the application keeps the sign-in screen up. There is no offline bypass |
Registration can be open, closed, or limited to the first account. The first account on an installation becomes its owner; later accounts join as members.
Ways to sign in
- Single sign-on. Any OpenID Connect identity provider configured for the installation, plus Google and GitHub sign-in. Google uses an authorisation-code flow with PKCE, and GitHub uses its device flow.
- Email codes. A one-time six-digit code sent to your address. It expires after ten minutes, works once, and dies after five wrong guesses. Requests are throttled per address.
- Local passwords. Available on installations without single sign-on, or where the operator enables them. Passwords are stored only as salted PBKDF2 hashes, and repeated failures lock the account temporarily.
A user can link more than one identity to an account and unlink them later.
Sessions and keys
- A session is an opaque random token. The service stores only its digest, so the token itself grants nothing to anyone who reads the database. Sessions expire after 30 days by default and can be refreshed.
- You can list your active sessions with their clients, and revoke one or all others.
- API keys let scripts and tools call the service as you. A key is shown once, when it is created, and can be revoked.
- In the desktop application, the session is kept with the operating system's secure storage, the desktop keyring on Linux, rather than in plain files.
Profile and your data
The account menu holds your profile (display name and avatar), linked identities, sessions and keys. You can export everything the service holds about you, or delete your account after confirming your email address. Security-relevant events are kept in an audit log.
Roles and plans
Accounts have one of four roles: owner, admin, member or viewer. Administrators can manage other users: their role, whether they are disabled, and their plan. The account layer also records a plan and its feature entitlements.
- Accounts live on the machine that runs the simulation service. There is no hosted account service in the current release.
- Plan entitlements are recorded and checked locally and advisorily. They are not a licensing or billing system.
- Accounts identify who is using LEVIATHAN. They are separate from the credentials LEVIATHAN uses to read remote data sources.