Security in the product
Activate security in the XPLG console, understand the internal and external realms and the Users → Groups → Policies model, and know what an administrator can and cannot do in each realm.
What you will do: switch the console from open access to authenticated access, pick the realm your users will come from, and find the four consoles everything else on this section uses.
Authenticated access is enforced on every product surface once security is active, and the security specification is explicit: default credentials must not be used in production, and external enterprise authentication (Active Directory or SSO) is the preferred, documented baseline. The internal realm remains the right choice for isolated and air-gapped sites. Every action of administrators and users is recorded in the product's audit log.
Activate security
- Open PortX > Settings > System Settings and the Security tab (PortX is the platform administration space of the console; older pages call it XpoLog Manager).
- Select Activate Security, keep or change the Session time out (30 minutes by default) and the Login URL (only for an external validation gateway), choose the Authentication types (the internal XpoLog Realm, Active Directory / LDAP, SiteMinder, WebSeal, Remote User; SAML and OAuth since build 7.9772), and save.
- The login page appears. Sign in and, if you are still on the installer's administrator account, change its password at once under Security > User General Settings.
- A Security menu is now in the left navigation with Users, Groups, Policies and User General Settings.
The SDK activates security remotely (-api settings -activateSecurity true) and can create the first users (-api securityUsers); see SDK and CLI reference. Configure after installation places this step in the post-install sequence.
Realms
| Realm | Who manages identities | What administrators do in XPLG |
|---|---|---|
| Internal (XpoLog Realm) — local users with managed passwords | XPLG | Create users, groups and policies; users change their own password and display name |
| External — Active Directory / LDAP, SAML 2.0, OAuth / OpenID, Kerberos, SiteMinder, WebSeal, header-based SSO | Your directory or identity provider; MFA and conditional access enforced there; XPLG consumes assertions and never stores federated credentials | Create groups and policies only; a user is resolved at sign-in to the matching group's policy |
Several types can be chained with a defined primary — see Sessions and authentication chaining.
The authorization model
- Policies are named permission sets: every allowed operation (view, edit, search, administration functions), assigned to groups or users. A policy with nothing selected is View-Only on folders and logs.
- Groups are role containers for users with identical duties; they mirror LDAP/AD groups one to one so that enterprise roles are inherited automatically. Every XPLG system has at least an Administrators and an All group.
- Users are local or federated identities, always resolved to a governing policy; a local user belongs to at least one group.
- Resource ACLs refine the policy per folder, per log and per app or dashboard, with distinct View and Edit roles per member, inherited from the parent, taken from the application or specified explicitly.
- Admin isolation: administrative access is restricted to approved users; the day-one baseline is a restricted View-Only default group; privileged activity is logged and alerted separately.
Governing principles are least privilege, need-to-know and segregation of duties: review access rights periodically, revoke on role change or departure, and segregate business units, applications or customers by removing broad groups from top-level folders and granting explicit group visibility per data domain.
Where things are
| Task | Console |
|---|---|
| Activate security, timeout, login URL, authentication types | PortX > Settings > System Settings > Security |
| Users, groups, policies | Security > Users / Groups / Policies |
| Your own password and display name | Security > User General Settings |
| Permissions on a folder or log | Data > Folders and Logs (Actions, or the Permissions button), or the Log Viewer's right-click menu |
| Permissions on an AppTag | AppTags > Security tab (shown only when security is active) |
| SSH connection policies | Data > SSH Connection Policies or Security > Authentication > Connection Policies |
Roles in dock (owner, admin, member) are separate from all of this; see Users and roles (sign in to read).
Next: Users
Source: XPLG wiki, pages 1594133408, 1594133402, 3161718811, 3161489438, 3161489481, 1594133410, 1597014018, 1594132942, 1594131106, 2095611905, 1594133390 (https://xpolog.atlassian.net/wiki/spaces/XPOL/pages/1594133408).
