Instance admin

The instance admin area holds settings that apply to the whole OpenLIT deployment rather than to one organisation or project. It has its own layout, without the organisation, project, or database switchers, and only instance admins can open it. The instance admin area has two pages:

• Auth: set up and test Google, GitHub, Microsoft, and Okta sign-in without redeploying.
• Admins: choose who else can manage instance settings.

​

Who is the instance admin

The first account created on the instance is the primary instance admin. On a standard install this is the seeded user@openlit.io account. On installs that don’t run the seed, it’s the first person to register.

• The primary admin can’t be removed, so the instance always has an admin.
• The primary admin can add more admins.
• Instance admin is separate from organisation roles. Being an organisation Owner doesn’t make someone an instance admin, and being an instance admin doesn’t change their organisation access.

​

Open the instance admin area

Instance admins see an Instance admin entry in two places:

• Settings in the sidebar
• The account menu at the bottom of the sidebar

Both open /admin. Anyone else who opens /admin is sent back to the home page, and the instance admin APIs return 403. Select Back to app in the admin sidebar to return to your organisation.

​

Availability

The instance admin pages need the OpenLIT Enterprise build and an active enterprise license on at least one organisation on the instance. They don’t need a specific license feature. Without a license, the pages are locked and the APIs return 403 with upgrade_required. In the community edition, /admin opens for the instance admin but has no settings pages.

​

Auth

Auth (/admin/auth) shows every sign-in provider OpenLIT supports. Saved values override the deployment’s environment variables and apply on the next sign-in, with no restart.

​

Provider status

Each provider tile shows whether its button appears on the sign-in page: A dot next to a provider’s name means it has unsaved changes. If more providers are available than fit on screen, use the arrows on either side of the row to scroll.

​

Configure a provider

To go back to the deployment’s value for a field, select Use deployment value below it and save.

​

Test credentials

Test credentials checks the values in the form with the provider before you save them. Empty fields use the saved or deployment value. Nothing is saved, and secrets are never shown in the result. The result shows whether the provider accepted the credentials, plus the provider’s error code when it didn’t (for example invalid_client). With the Microsoft tenant set to common, Microsoft may not confirm credentials that are correct, and the test reports that they couldn’t be confirmed. Set a single directory for a definite answer.

​

Validation and storage

• The Okta issuer must be a public https URL. IP addresses, localhost, and addresses that resolve to a private network are rejected.
• The Microsoft tenant must be a directory ID, a domain, common, organizations, or consumers.
• Saved values are encrypted at rest.
• Saving is recorded in Audit Logs as instance_auth.updated, listing only the changed variable names, never their values.

​

Admins

Admins (/admin/admins) lists everyone who can manage instance settings. For each admin it shows who added them and when.

​

Add an admin

1. Enter the person’s email under Add an admin by email.
2. Select Add admin.

The person needs an OpenLIT account on this instance first. Ask them to sign up or sign in once before you add them. They get access to the instance admin area on their next page load.

​

Remove an admin

Select Remove next to an admin and confirm. They lose access to instance settings on their next request. Their account and organisation access don’t change.

• The primary admin can’t be removed.
• You can’t remove yourself. Ask another admin to remove you.

Adding and removing admins is recorded in Audit Logs as instance_admin.added and instance_admin.removed.

​

Audit logs

Instance admin actions are recorded against the acting admin’s current organisation, when that organisation is licensed for Audit Logs.

​

Troubleshooting

---