Platform administration

The platform console manages the installation as a whole: which teams exist, their limits, and the settings every team shares. It is a separate application with its own address, its own sign-in and its own database account. Platform administrators cannot see team members, scans, findings or any other team data, and cannot join a team through the console.

Deploying the console

The console signs in only through a dedicated OpenID Connect application at your identity provider; it has no passwords. It runs next to ScanSuite from docker-compose.platform.yml, or through the Terraform deployment with platform_console_enabled = true, and should be reachable from the internal network only.

1. 01
   Create its database account

   Run python -m platform_console.database --role scansuite_platform with the schema owner's credentials, then give the role a login password. It can read and change only the platform tables.

2. 02
   Register it with the identity provider

   A confidential client with the redirect URI https://<platform host>/auth/callback.

3. 03
   Create the first platform administrator

   python -m platform_console.bootstrap --subject <immutable subject of that person at the provider>.

4. 04
   Configure and start it

   Set the PLATFORM_* settings (its own secret key, database URI, Redis URI, OIDC client and wrapping keys) and start the service.

Platform groups

The console hides what a group cannot use, and the server refuses it either way. Removing a group takes effect immediately. The last active root administrator cannot be removed.

zoom_inEnlarge

zoom_inEnlarge

Teams

The Teams section lists every team with its status and limits.

zoom_inEnlarge

After creating a team, give it a first administrator with a one-time claim (see Members and accounts, "Accounts from the command line"). From then on, the team manages its own members.

Limits

A team without limits is not limited and keeps all of its scans. Lifecycle sets the limits proposed for new teams.

Deleting a team

Archive the team, then click Schedule deletion. Its data is deleted after the grace period set under Lifecycle (30 days by default). Until then, Cancel deletion, or setting the team active again, stops it.

When the date passes, ScanSuite deletes the team's stored files and all of its data. The team itself remains, marked deleted, so historical references still resolve. The platform audit log records how many rows were deleted, and nothing else. The deletion runs inside ScanSuite, within the team's own scope; the platform console never reads team data.

System settings

Changes need a recent sign-in and are recorded in the platform audit log.

zoom_inEnlarge

zoom_inEnlarge

zoom_inEnlarge

Platform secrets

The AI key of the system configuration is stored encrypted and is never shown again. Saving a new key replaces it; the previous version stays usable by scans that started with it until you Revoke it under Platform secrets. The version in use cannot be revoked.

zoom_inEnlarge

The encryption keys themselves are rotated on the server, without decrypting any stored value:

# after adding the new key to the key set and making it the active key
docker compose run --rm migrate python -m configuration.rewrap
docker compose run --rm migrate python -m configuration.rewrap --check

Remove the old key only when --check reports that nothing uses it.