User Management

ShadowTrackr supports multiple users per organization, each with a role that determines what they can see and do. You can manage users from the Settings page.
ShadowTrackr also supports Multi Factor Authentication (MFA) and Single Sign-On (SSO). Any organization administrator can enable these on the Security tab of the settings page. See Multi Factor Authentication and Single Sign-On below.

Roles and permissions

Every user is assigned one of the following roles:

Role	Description
Role: Group administrator	Description: Can manage all organizations within a group. Has full access to all settings and data across the group. Use this role for people who oversee multiple organizations. Note that this role is only available in multi-tenant subscriptions.
Role: Organization administrator & contact	Description: Full access to the organization's settings and data, and the ability to manage users. This user is also the primary contact for the organization .
Role: Organization administrator	Description: Full access to the organization's settings and data, and the ability to manage users. This role is not designated as the primary contact.
Role: User	Description: Can view and interact with all data, including creating reports, setting alerts, and running queries. Cannot change organization settings or manage users.
Role: User (read only)	Description: Can only view data. Cannot make any changes, add assets, modify settings, or create reports.

Inviting users

To invite a new user, go to the Settings page and add their email address. They will receive an invitation to join your organization. You can assign their role at the time of invitation and change it later if needed.

Removing users

You can remove users from your organization at any time from the Settings page. Removing a user revokes their access immediately. Any alerts or reports they created will remain in place.

Multi Factor Authentication

Multi Factor Authentication (MFA) adds a one-time password (OTP) step on top of the normal username and password login. ShadowTrackr uses the standard time-based one-time password (TOTP) algorithm, so it works with any authenticator app. Google Authenticator and Microsoft Authenticator are confirmed to work, and other TOTP apps (such as Authy, 1Password, or Bitwarden) work as well.

MFA is configured per organization by an administrator:

Go to the Security tab on the Settings page.
Under Multi Factor Authentication, set Authentication to "2FA with Google Authenticator".
Click Save MFA settings.

Once MFA is enabled for the organization, every user is prompted to enrol the next time they log in: they scan a QR code with their authenticator app and confirm the generated 6-digit code. From then on, each login requires the current code from the app. An administrator can see each user's enrolment status ("enrolled" or "waiting for QR code scan") and reset a user's MFA enrolment from the Users tab — useful when someone loses their device.

Note: when SSO is used, MFA is handled by your identity provider. A successful SSO login satisfies the MFA requirement, so the organization MFA setting above does not apply to users who sign in through SSO.

Single Sign-On (SSO)

Single Sign-On lets your users log in to ShadowTrackr with your own identity provider (IdP) instead of a ShadowTrackr password. ShadowTrackr acts as an OpenID Connect (OIDC) client, so any OIDC-compliant provider works — including Microsoft Azure AD / Entra ID, Okta, and Keycloak. Accounts are provisioned automatically on first login and linked on the durable provider identity (issuer + subject), never on email alone.

SSO is configured per organization on the Security tab, in the Single Sign-On (SSO) card. The settings are:

Field	Description
Field: SSO name (slug)	Description: A short identifier for your organization using only lowercase letters, numbers and dashes (e.g. acme). It is used in the login URL /usr/sso?org=<slug>.
Field: Provider	Description: Choose "Microsoft Azure AD", "Okta", or "Generic OIDC". Use "Generic OIDC" for Keycloak and any other standard provider.
Field: Issuer / discovery URL	Description: The OIDC issuer URL of your provider. It must start with https://. ShadowTrackr appends /.well-known/openid-configuration to discover the endpoints automatically.
Field: Client ID	Description: The client / application ID issued by your provider when you register ShadowTrackr as an application.
Field: Client secret	Description: The client secret issued by your provider. It is encrypted at rest. Leave this field blank when editing to keep the stored secret unchanged. Note that for Microsoft Entra ID you need to copy the value of the client secret, not the ID of the secret.
Field: Allowed email domains	Description: Optional comma-separated list (e.g. example.com, example.org). When set, only users whose verified email ends in one of these domains may sign in.
Field: Enable SSO	Description: Turns SSO on. Users can then log in with the "Log in with SSO" button on the login page or directly at /usr/sso?org=<slug>.
Field: Require SSO	Description: Disables password login for everyone in the organization. Only enable this after you have confirmed SSO works, or you may lock everyone out.

Before you start, register ShadowTrackr as an application with your provider using the Redirect URI shown on the Security tab. It has the form:

https://<your-shadowtrackr-domain>/usr/sso_callback

ShadowTrackr requests the openid, email and profile scopes, so make sure your provider returns an email address for each user.

SSO example: Azure AD / Microsoft Entra ID

In the Microsoft Entra admin center, go to App registrations → New registration. Add the ShadowTrackr Redirect URI as a Web platform redirect URI, then create a client secret under Certificates & secrets. Enter the resulting values in ShadowTrackr:

ShadowTrackr field	Example value
ShadowTrackr field: Provider	Example value: Microsoft Azure AD
ShadowTrackr field: Issuer / discovery URL	Example value: https://login.microsoftonline.com/<tenant-id>/v2.0
ShadowTrackr field: Client ID	Example value: The Application (client) ID from the app registration overview
ShadowTrackr field: Client secret	Example value: The secret Value from Certificates & secrets (copy it immediately — it is only shown once)
ShadowTrackr field: Allowed email domains	Example value: yourcompany.com

The <tenant-id> is the Directory (tenant) ID shown on the app registration overview. Azure AD / Entra returns openid, email and profile by default, so no extra API permissions are required for sign-in.

SSO example: Keycloak

In the Keycloak admin console, open your realm and go to Clients → Create client. Choose OpenID Connect, set a Client ID, then on the next step turn Client authentication ON (a confidential client) and add the ShadowTrackr Redirect URI under Valid redirect URIs. After saving, copy the secret from the client's Credentials tab.

ShadowTrackr field	Example value
ShadowTrackr field: Provider	Example value: Generic OIDC
ShadowTrackr field: Issuer / discovery URL	Example value: https://keycloak.example.com/realms/<realm>
ShadowTrackr field: Client ID	Example value: shadowtrackr
ShadowTrackr field: Client secret	Example value: The secret from the client's Credentials tab
ShadowTrackr field: Allowed email domains	Example value: yourcompany.com

On older Keycloak versions (before 17) the issuer URL includes an /auth path segment: https://keycloak.example.com/auth/realms/<realm>. Keycloak includes the email and profile scopes by default, so users' email addresses are returned automatically.