Agentless Portal — Kunan Technology

Audience: members (managed personnel) — and the administrators who support them.

The Agentless Portal is a separate application from the Console. It has exactly two screens: sign in, and your services. Everything administrative stays in the Console.

What you can do here

As a member, I want to sign in with the account I was given, so that I can reach my services.
As a member whose account requires MFA, I want to enroll and verify in place, so that I do not need a second tool.
As a member, I want to see the services I am allowed to use, so that I do not have to remember addresses.
As a member, I want to open a service in one click, so that access is not a technical exercise.

1. Getting in

Route: /login

Open the portal URL your administrator gave you. Production hosts follow the convention portal-<environment> on your organisation’s Merak domain.
Enter your email and password.
Select sign in.

Use your member account. Console administrator accounts belong in the Console; member accounts belong here.

What you see	Meaning
Invalid credentials	Wrong email or password.
Account locked	Ask your administrator to unlock it.
Account disabled	Ask your administrator to re-activate it.
Rate limited	Too many attempts. Wait and try again.

2. Multi-factor authentication

The portal handles MFA itself — nothing is handed off to the Console.

2.1 You already have an authenticator

A six-digit code prompt appears after your password is accepted. Enter the current code from your authenticator app. A refused code keeps the prompt open with the field marked in error — wait for the next code.

2.2 You have never enrolled, but policy requires it

An enrollment dialog opens instead:

Scan the QR code, or copy the secret into your authenticator manually.
Enter the six-digit code.
Submit. Enrollment finishes and the same code completes your sign-in.

Closing the dialog cancels the attempt cleanly — nothing is enrolled, and a secret you walked away from is never shown to the next attempt.

2.3 Why you may be asked for a second code

One sign-in spends your credentials on two things: your portal session and a separate grant that lets you open services. Both are MFA-protected, and a TOTP code can normally be used only once — so if the second call refuses the code the first one just used, the prompt asks for the next code, clears the field, and replaces Cancel with Skip.

Stage	If you cancel or skip
Session	Cancel abandons the sign-in entirely.
Service	Skip signs you in anyway. You will see your service list, with a warning that services cannot be opened. Sign in again to fix it.

There is nothing to “resend” — a TOTP code is generated by your own app, not sent to you. Your administrator can remove the second prompt entirely by allowing code reuse in the identity provider’s policy; nothing changes in the portal either way.

3. Your services

Route: /

The home page is the service list: one card per application you may reach that has agentless access switched on.

State	What you see
Loading	A skeleton grid.
Error	An error with a retry.
Empty	An empty state.
Ready	A responsive grid of one to three columns.

“Empty” covers two situations you cannot distinguish and do not need to: you have no application access at all, or none of the applications you can reach has agentless switched on. Ask your administrator either way.

3.1 What each card’s button does

Service state	Button
Active, with an entry point	Open — enabled.
Active, no entry point yet	Disabled: “entry point unavailable”.
Provisioning	Disabled: “preparing…” with a spinner.
Error	Disabled: “preparing…“.
Not yet reported	Disabled: “preparing…” with a spinner.

There is deliberately no retry button on an error. The backend re-drives provisioning on its own, and a retry control would imply an operation you have no permission to perform. If a card stays in error, tell your administrator.

3.2 Opening a service

Select Open. The service opens in a new browser tab.

Two things follow from how this works, and are worth knowing:

Opening is a button, not a link. Right-click → copy link, or a middle-click, will not give you a working address — the credential that makes the address work is attached at the moment you click. A copied link lands on a bare error page.
If your access has expired, the card tells you so instead of opening. Sign in again.

4. Known limitations

Ask your administrator about these; none of them is something you can fix from the portal.

Limitation	What it means for you
An MFA account may be asked for two codes.	See §2.3. The identity policy can collapse it to one.
A listed service may still refuse to open.	The list reflects the application-level agentless switch. Actual authorization is per member. If you reach an application only through an organization, you may see the card and be refused at connection time. Your administrator must bind you individually — see 03 · Applications §8.4.
Access to services expires after about 30 minutes.	The credential collected at sign-in cannot currently be renewed. Sign in again and the card will open.

5. For administrators supporting the portal

The member-facing behaviour above maps onto Console settings like this:

Symptom the member reports	What to check in the Console
”I see no services at all”	Does the member have any application access? Is agentless switched on for any of those applications? See 03 · Applications §8.
”A card says preparing and never changes”	The application’s agentless status is `provisioning` or `error`. Check the application’s detail page.
”A card says entry point unavailable”	Agentless is on but the access URL has not been assembled yet.
”I click Open and get an error page”	Most often the per-member binding is missing. Check the member’s agentless seat and the application’s agentless authorized members. See 02 · Members §6.
”It stops working after a while”	The service grant has lapsed. Ask them to sign in again.
”I get asked for two codes”	Expected when TOTP reuse is disallowed in the realm policy.

Remember that both agentless layers must be in place:

The member holds an agentless seat (member detail).
The member is bound to that application (either card).

And the application itself must have agentless switched on, which requires an http/https protocol, an active tenant agentless feature, and free service quota.

Set up the access this portal exposes: 03 · Applications
Grant seats and bindings: 02 · Members §6