Users & access control

sol2docker authenticates users and enforces role-based access control on the server. The client only gates what UI it offers — never rely on it for security. Every route, and every SSE/WebSocket stream, is gated by a capability on the server.

Sign-in methods

• Local login — passwords hashed with argon2id, optional TOTP 2FA (RFC 6238).
• OIDC / SSO — Authorization-Code flow, with auto-provisioning and group → role mapping re-synced on each login. See Single sign-on (OIDC).
• API tokens — Authorization: Bearer s2d_…, inheriting the owner's roles, honoring a read-only scope and an expiry.

Login issues a JWT in an httpOnly cookie (so it rides SSE/EventSource, which can't set headers). The token carries a session id so a single session can be revoked, and a token epoch you can bump to revoke every session at once.

Brute-force protection

Failed logins are throttled per (IP + username) with an escalating lockout, and a coarse per-IP rate limit guards the whole API surface.

Accounts

My Account covers profile, appearance, 2FA, change password, API tokens (read-only scope + expiry), and your active sessions with individual revoke.

Admin user management can create users, assign/remove roles, disable/enable, reset passwords, and delete (with self-protection so you can't lock yourself out).

Roles & capabilities

RBAC is defined by a route → capability table on the server. When a request arrives, sol2docker unions the capabilities of the user's role assignments scoped to the target environment, so access can differ per environment.

Built-in roles

These four roles ship with sol2docker. Use the id wherever a role is referenced by name — role assignments, OIDC group mappings, and SOL2DOCKER_OIDC_DEFAULT_ROLE.

Role id	Scope	What it grants
platform_admin	Workspace	Full auth, environment, and runtime control.
platform_operator	Workspace	Runtime control across environments, without auth administration (no user/role/environment management).
environment_operator	Environment	Mutable runtime access inside the environments it's assigned to.
environment_viewer	Environment	Read-only runtime observability.

Workspace-scoped roles apply everywhere; Environment-scoped roles are granted per environment, so a user can operate one environment and only view another.

Beyond these, custom roles and built-in role overrides let you tailor capabilities, all managed from a dedicated Roles page.

First-boot admin

With no users, sol2docker creates an admin account (password from SOL2DOCKER_ADMIN_PASSWORD or generated and logged once) and grants it the global platform_admin role. Change the password and set up 2FA right after first login.