Security & Access Control
StacksAtlas is built for networks where scan data should stay on site. Access control, encryption, and optional SSO are covered below.
Data Sovereignty (The "Zero-Knowledge" Policy)
Unlike SaaS monitoring tools, StacksAtlas assumes your network data is sensitive and should never leave your premise.
- No Cloud Telemetry: The application does not collect usage statistics, anonymized crash reports, or device inventory metadata.
- Encrypted-at-Rest: The internal LiteDB database is encrypted using AES-256 (FIPS 140-2 compliant algorithms).
- License Isolation: The license validation service (
api.lemonsqueezy.com) only receives your license key and a unique hardware ID. No technical details about your scanned subnets are included in this handshake.
Access Control (RBAC)
To support multi-user teams, StacksAtlas implements a granular Role-Based Access Control system.
| Role | Permissions | Use Case |
|---|---|---|
Administrator | Full system control: global settings, user management, license activation, and audit log. | IT Manager / Owner |
Standard User | Operational access: device names, location management, and alert acknowledgment. | Network Technician |
Viewer | Read-only access: dashboard monitoring and report generation. | Management / Auditor |
Alert Only | Notification access: receives email/webhook triggers (no dashboard access). | Emergency Contact |
Day-to-day account administration (CSV import, password reset, per-user alert preferences) is documented in User management. Configure SSO under Settings → AUTH (SSO).
Enterprise Identity & SSO (v1.2.7)
StacksAtlas now supports production-grade external identity providers, allowing your team to use existing corporate credentials (SSO) to access the appliance.
OIDC (OpenID Connect)
Integrate with any modern identity provider (IdP) such as Google Workspace, Microsoft Entra ID (Azure AD), Okta, or Auth0.
- Dynamic Metadata Discovery: Simply provide the Issuer URL, and StacksAtlas will automatically discover endpoints and signing keys.
- JIT (Just-In-Time) Provisioning: Users are automatically created in StacksAtlas upon their first successful login, pulling their name and email from the IdP claims.
LDAP / Active Directory
For internal environments, StacksAtlas provides a high-performance LDAP/AD bridge.
- Bind-Based Authentication: Uses your existing directory hierarchy for password verification without storing external credentials locally.
- Secure LDAP (LDAPS): Full support for encrypted directory communication and certificate validation.
Dynamic Role Mapping
You can map external directory groups (LDAP) or OIDC claims to StacksAtlas roles (Admin, Standard, Viewer) via the UI.
- Navigate to Settings → AUTH (SSO).
- In the Role Mapping section, add a new rule.
- Specify the External Group/Claim (e.g.,
CN=Network Admins,OU=Groups,DC=corp) and choose the corresponding StacksAtlas Role. - When users log in, the appliance will automatically assign their permissions based on these rules.
Pre-flight Diagnostics
To ensure a smooth setup, the appliance includes a Diagnostic Pre-flight tool. You can test your LDAP bind credentials or OIDC metadata reachability directly from the configuration UI before enabling SSO globally.
Authentication & Cryptography
- PBKDF2 Hashing: User passwords are never stored in plain text. Passwords are hashed with PBKDF2 and unique salts.
- JWT Architecture: All communication between the browser and the background service is secured via JSON Web Tokens (JWT), ensuring stateless and tamper-proof sessions.
- HTTPS & CA Maturity (v1.7.5+): First launch is HTTP-first at
http://127.0.0.1:5000(Windows/Docker) or:5050(macOS), without certificate warnings. An optional onboarding step lets you trust the local CA for HTTPS on port 5001.- Certificate Logic: The appliance uses .NET 10 X509CertificateLoader APIs to generate self-signed certificates with Basic Constraints: CA=True.
- Trust Workflow: Administrators can download the appliance root certificate from Settings or complete the guided trust step in onboarding.
- Protocol Hygiene Warnings: The UI provides explicit warnings when using unencrypted Protocol Quick Links (Telnet/FTP), ensuring administrators are aware of the risks of clear-text credentials in the environment.
Audit log (v1.8.9+)
Administrators can review who did what on the appliance from the Audit Log nav item (
/audit), next to Logs. Access is Admin-only; the page title does not need to say "Admin."This is a dedicated append-only store of human actions (not engine noise), separate from:
- Logs (
/logs): real-time engine / Serilog diagnostics - Alerts → Audit / Replay: notification dispatch and fleet governance records
- System Events: discovery and network timeline noise
What is recorded
| Action family | Examples |
|---|---|
| Authentication | Local login success / failure, SSO login, first-run admin setup |
| Users | Create, update (role/email), delete, password reset |
| API tokens | Create and revoke (sa_ keys) |
| Licensing | License activation |
| Settings | Ports/syslog, debug logging, SSO/auth, network/scan policy, polling, email (SMTP host only), OpenAVC base URL metadata |
| Webhooks | Create, update, delete (URLs/secrets never stored in the log) |
| Federation | Enroll, decouple, node update/delete, site reset |
| Device governance | Archive, remove from fleet, restore, security risk acknowledge |
| Snapshots / reset | Create, restore, delete, fresh-start |
| Security / database | Encryption key rotate, portable import/export, fleet database apply |
Secrets (passwords, full API tokens, license keys, webhook URLs) are never written to the log. Failed logins record the attempted username only.
Access, federation, and retention
- Admin only (UI and
GET /api/audit/events). Viewers and Standard users cannot read the log. - Federation: Nodes record locally and push audit rows to the Hub. On a Hub, filter by site with the node selector.
- Syslog / SIEM (Business): when syslog export is enabled, each audit row is also forwarded as a structured
AUDITmessage. - Retention: events live with the appliance database. There is no automatic purge. Rows are removed only by factory reset, intentional database wipe, or uninstall with data purge. Default UI window is the last 24 hours; operators can expand the window or load older pages.
Procurement summary: Trust Center (Logging & audit).
Infrastructure Resilience
- Sandboxed Environment: The engine adapts to the host's security model. It can run as a standard Windows Service with restricted Service Accounts, a natively constrained macOS Daemon, or a fully isolated, unprivileged Docker container.