Authentication and Roles

Authentication and Roles

🇪🇸 Español

With DASHBOARD_AUTH_ENABLED=true (the default), every page and data API requires a session. An incomplete or invalid configuration blocks access; Goliat never falls back to public mode.

Sign-in modes

Demo mode

DASHBOARD_AUTH_MODE=demo
DASHBOARD_USERNAME=<user>
DASHBOARD_PASSWORD=<password>
AUTH_SECRET=<32+ random bytes>

A single user and password, with a login screen that also works without JavaScript. Useful for local development and evaluation. Demo mode has no Administration or Members sections.

Microsoft Entra ID

DASHBOARD_AUTH_MODE=azure-ad
AUTH_MICROSOFT_ENTRA_ID_ID=<application client ID>
AUTH_MICROSOFT_ENTRA_ID_SECRET=<client secret>
AUTH_MICROSOFT_ENTRA_ID_ISSUER=https://login.microsoftonline.com/<tenant-id>/v2.0

1. Register a web application in Microsoft Entra ID.
2. Add the redirect URI <AUTH_URL>/api/auth/callback/microsoft-entra-id.
3. Set the variables above. Only that tenant is accepted (single tenant, PKCE, Auth.js).

When deploying with .\goliat.ps1 deploy -AuthMode tenant, the application and its callback are created for you. See Deploying to Azure.

The user photo is fetched once at sign-in from Microsoft Graph with the delegated User.Read permission and kept as a 48×48 thumbnail in the session.

Sessions

• JWT cookies: HttpOnly, SameSite=Lax, valid for 8 hours.
• AUTH_SECRET must be at least 32 random bytes and identical on every replica.
• Changing the sign-in mode invalidates existing sessions.
• Dashboard credentials are independent from the identities used by the collector.

Goliat roles

Role	Access
Member	Azure inventory, FinOps and architecture.
Administrator	Everything above, plus Administration, inventory schedule and Members.

These roles are not Azure RBAC roles or Entra directory roles. Goliat never modifies users, passwords, groups, licences or directory role assignments.

Initial administrators

Initial administrators are identified by their object ID in the dashboard tenant, never by name or email:

.\iac\configure-administration.ps1 -ObjectIds '<user-object-id>'

Locally, set DASHBOARD_ADMIN_OBJECT_IDS. The list is evaluated on every request. After administration is enabled for the first time, the user must sign out and sign in again so the session includes oid and tid. Initial administrators are the recovery path: they cannot be revoked from the UI.

Members view

The optional Members view lets administrators search accounts of the tenant and grant or revoke the Goliat administrator role, with confirmation and an audit trail in PostgreSQL.

.\goliat.ps1 members
# Without direct PostgreSQL connectivity from your machine:
.\goliat.ps1 members -DatabaseFromWeb

The command grants only the Microsoft Graph application permission User.Read.All to the web managed identity. An authorised Entra administrator must give consent; owning the subscription is not enough. It stops if the application requires user assignment (appRoleAssignmentRequired=true).

Rules enforced by the server:

• Administrators cannot change their own role, and protected initial administrators cannot be changed.
• Disabled accounts cannot receive new grants.
• Roles are re-checked on the server on every request; a stale session does not keep revoked rights.
• Concurrent edits are serialised. A stale list returns 409 role_conflict instead of overwriting another change.

Full reference: docs/members.md and docs/administration.md.