Authentication Setup

This guide covers configuring authentication for Rumi Admin.

Overview

Rumi Admin supports multiple authentication mechanisms through a plugin architecture. Authentication can be configured to use LDAP (delegated to Grafana) or Okta SSO.

Authentication Plugins

LDAP

LDAP authentication is handled by Grafana's built-in LDAP support. When enabled, Rumi Admin delegates authentication to Grafana.

To enable LDAP:

1. Set the LDAP configuration in ecosystem.json:

   {
     "ldap": {
       "enabled": true
     }
   }

2. Configure Grafana's LDAP settings in the Grafana configuration file (typically ldap.toml).

See the Grafana LDAP documentation for details on configuring the LDAP connection, bind DN, search filters, and group mappings.

Okta SSO

Okta authentication uses the oktajs library to validate credentials directly against Okta.

To enable Okta:

1. Configure Okta settings in ecosystem.json:

   {
     "okta": {
       "enabled": true,
       "token": "<your-okta-api-token>",
       "domain": "<your-okta-domain>"
     }
   }

2. The Admin UI will present a login form that validates credentials against Okta's session API.

A successful authentication creates an active Okta session and grants access to the Admin interface.

User Management

Rumi Admin stores user settings in a rumi_users table in the shared SQLite database:

• Per-user settings — Including the disable_cnc flag to restrict command-and-control access.

• Organization membership — User-to-organization mappings from Grafana's user model.

Listing Users

Administrators can view all registered users through the Admin API:

GET /nvx/users

User Settings

Per-user settings can be managed through the Admin API:

GET /nvx/user        # Get current user settings
POST /nvx/user       # Update user settings
DELETE /nvx/user     # Remove user settings

Global Configuration

Global settings that affect all users can be managed through:

GET /nvx/config      # Get global config
POST /nvx/config     # Set global config
DELETE /nvx/config   # Remove global config

The global_disable_cnc setting disables command-and-control for all non-admin users, providing a monitoring-only mode.