Formats and running it
SSO, roles, IP allow lists and break glass
Permissions are checked on the server for every request. The portal hides buttons you cannot use, but that is tidiness, not the control.
Five roles
viewer reads rules, packages and vulnerabilities. developer adds asking for packages, walking trees and their own tokens. publisher can publish under reserved names with npm publish, twine upload, docker push or dotnet nuget push, usually a CI account. approver edits rules and decides requests and waivers. admin does everything, and is the only role that can even read settings, allow lists and keys. Admins can impersonate a user for support, recorded as admin as jsmith, for 30 minutes at most, and never to take over an account.
Single sign on
OpenID Connect with the authorization code flow and PKCE, against Okta, Entra ID, Google, Keycloak and the rest. The ID token signature is checked against the provider's published keys before a word of it is believed, and a replayed login finds its state already spent. SAML is not supported and not planned. If the provider is down in sso_only mode, enable_local_login.sh on the server puts the password form back, through the app's own code and into the audit trail.
Two allow lists
Whitelist Admin Portal decides which networks can reach the portal, and everybody else gets a flat 404. Whitelist Clients decides which networks can pull packages, can fetch GitHub's runner ranges itself, and can let a valid token through from anywhere. A break glass key, stored as a SHA-256 and shown once, gets you back in if your office address changes.
In short
- viewer, developer, publisher, approver and admin, enforced by the API
- OIDC with PKCE, just in time accounts, no admin by SSO
- Separate portal and client network allow lists
- GitHub Actions ranges fetched daily, or a token as the way through
- Break glass keys, rate limited and audited
In the documentation
- Users and roles Administrator Guide
- Single sign-on Administrator Guide
- Portal allow list and break glass Administrator Guide
Goes well with
- Tokens, apps and environments Every download is tied to a token, an application and an environment. Rules can be scoped to them.
- Audit trail Every sign in and every change, with before and after, who, from where, and whether it worked.
- SIEM and email Signed webhooks, Splunk HEC and syslog in JSON or CEF. Digests instead of a mail per event.
One container, about two minutes
A Linux box with Docker, or one without it, and a reverse proxy for TLS. The installer does the rest and it is safe to run twice. Free, MIT licensed, nothing to sign up for.