Users, roles & 2FA

Managing who can sign in to the dashboard, what they can do, and securing those accounts.

Where you do this: Cloud dashboard — kilasec.com/app/. Users & Roles for people; Settings → Account for your own password, 2FA, and sessions; Settings → Access & SSO for single sign-on and the workspace's active sessions. Inviting, role changes, SSO, and revoking other people's sessions require the tenant_admin role; everything under Account is available to any signed-in user.

Roles

Role	Can do
member	view the workspace
tenant_admin	manage policy, collectors, approvals, and users

Roles are set on Users & Roles by a tenant_admin, not self-selected.

Inviting people

Dashboard → Users & Roles. Access is account-based — there's no open signup. Add a teammate by email and pick their role; they set their own password on first sign-in and join your workspace. See Add a teammate. Change a role or disable an account from the same page at any time.

Two-factor authentication (2FA)

Kilasec supports authenticator-app 2FA (TOTP) with one-time recovery codes.

Enrolling — Dashboard → Settings → Two-factor authentication → Set up 2FA. Scan the QR with any authenticator app (Google Authenticator, 1Password, Authy) or enter the key manually, then confirm with a code. You're shown recovery codes once — save them; each works one time if you lose your authenticator.

Signing in with 2FA — after your password, you're prompted for the 6-digit code (or a recovery code). The password step alone does not create a session on a 2FA account.

Turning it off — requires re-entering your password, so a hijacked session can't silently strip the second factor.

We recommend every admin enrolls — the account holds control over your policy and fleet.

Passwords

Changing yours — Settings → Account → Password. Enter the current password and a new one (at least 8 characters). Every other browser signed in to your account is signed out; the one you're using stays signed in.

Forgot it — click Forgot password? on the sign-in page and enter your email. If the address belongs to an active account, Kilasec emails a reset link (the page says the same thing either way, so it can't be used to probe which emails have accounts). The link is single-use and expires in 1 hour; requesting another one cancels the previous link. Choosing a new password signs you out everywhere, including any session you didn't start. 2FA is unchanged — you still enter your code at the next sign-in.

Resetting a teammate's — on Users & Roles, Reset password generates a one-time temporary password, shown once. Give it to them over a secure channel; they set their own under Settings → Account after signing in. All of their existing sessions are ended. Both kinds of reset are recorded in the Audit Log.

Sessions

A browser session lasts 7 days from sign-in. There is no idle timeout, so a session stays valid until then, until the user signs out, or until it's revoked.

• Your own — Settings → Account → Sign out everywhere else ends every session on your account except the one you're using.
• The whole workspace — Settings → Access & SSO → Active sessions (tenant_admin) lists every browser signed in to the workspace: who, which browser, when it was last active, and when it expires. A Kilasec support session viewing your workspace is listed too, tagged Kilasec support. Revoke ends that session immediately; revoking your own (this device) signs you out. Revocations are audited.
• API-key use — if the workspace API token was used recently, it appears in the same list with its prefix and source IP. A key holds no session to revoke; rotate the token on the API Access page to cut it off.

Single sign-on (SSO)

Kilasec supports SSO over OpenID Connect with any standard IdP (Okta, Auth0, Entra, Google). Configure it under Settings → Access & SSO → Single sign-on (SSO):

1. In your IdP, create an OIDC web app and register the Redirect (callback) URL shown on the page.
2. Paste the Issuer URL, Client ID, and Client secret. The secret is write-only: it's stored encrypted and never shown again — leave the field blank to keep it.
3. List your Email domains, comma-separated (e.g. acme.com, acme.io).
4. Choose Auto-create accounts (JIT) — create a member account the first time someone from a verified domain signs in — or leave it off to require an invite first.
5. Tick Enable SSO and Save SSO settings.
6. Verify each domain (below), then test with Sign in with SSO on the login page.

Verifying your email domains

A domain only routes sign-ins to your IdP, and only auto-creates accounts, once you've proved you own it. After you save, each domain is listed under Domain verification as Verified or Unverified — won't route logins. For each unverified domain:

1. Publish the DNS TXT record the page shows:

   Name	Value
   _kilasec.<your-domain>	kilasec-domain-verify=<token>

2. Click Verify now. If the record isn't visible yet (DNS can take a while to propagate), you'll get TXT record not found — wait and try again.

A domain can be verified by only one workspace; if another workspace already owns it, verification is refused. Domains that were configured before verification was introduced were marked verified automatically, so existing SSO sign-ins kept working. Someone who tries to sign in under an unverified domain is told to ask their admin to verify it in Settings → Access & SSO.

Changing a login email

Login email can be changed without disturbing the password or 2FA (they're keyed to the account, not the address). If you need to change the address on an account, contact Kilasec.