Local accounts

For security best practices, integrate your identity provider with Coherent's Keycloak.

See IAM fundamentals and Benefits of identity provider versus local accounts.

tenant-admins can create local user accounts if Single sign-on is not configured.

View users

1. Sign in using tenant-admin credentials.

2. Select Options from the User menu.

3. Select Users.

Change how users are displayed

• Activated / Deactivated: Select between viewing activated users and deactivated users.

• Search: Enter a search term and the list will update.

• Filter: View only users who are members of the selected user group.

• Sort: Change the sort order of the items by selecting the List view headers.

• Select View user groups to see the user groups the user is a member of.

Add user

1. Select New user.

2. Enter the First name, Last name, and Email.

3. Select how you would like to add user to user groups:

   • Apply existing user's settings: Search for a user and copy their user group membership.

   • Select user groups: Select the user groups. Make sure to include user:pf as it is required for sign in.

4. Enable multifactor authentication for local accounts for better security. Select Require Multi-Factor Authentication.

5. To set an expiration date on the account, enable Set expiration date and time and entering a date and time. This is useful to provide limited access to other users who need to access your tenant temporarily.

6. Select how you would like to add user.

   • Invitation link: The user will receive a "Complete your registration" email. This is recommended as it verifies the user account.

   • Create credentials: Enter a password for the user or select Generate if you want Spark to generate a secure password. Make sure to copy the password before continuing.

7. Select Submit.

Edit user

1. Select the ellipsis menu and select Edit user.

2. Change the First name, Last name, user groups, multifactor authentication, access expiration, or Invitation link.

3. Select Submit.

Deactivate users

Users cannot be deleted from Spark in order to maintain auditing and tracking of events.

1. Select the ellipsis menu and select Deactivate user.

2. The Deactivated users screen will display with the deactivated user at the top of the list.

3. The user account will be deactivated and no longer able to access Spark.

Multifactor authentication sign in

Authenticator apps

• FreeOTP: Apple App Store, Google Play

• Google Authenticator: Apple App Store, Google Play

• Microsoft Authenticator: Apple App Store, Google Play

1. When the user signs in for the first time, they will be prompted to open the authenticator app and to scan the provided QR code.

2. Input the number generated by the authenticator app into the One-time code field.

3. Under Device Name, enter a name to identify the device that is being used.

4. Select Submit.

5. For each subsequent sign in, the user will be prompted to provide the one-time password from the authenticator app.

Prevent brute force attacks

1. Sign in to the target Spark tenant. Access the Keycloak console from the User menu.

2. Follow the instructions in the Keycloak Server Administration Guide to adjust the Security defences for Brute force detection.