Getting Started

What you can do here

• As a new administrator, I want to sign in to the Console, so that I can start managing access.
• As an administrator whose account was just created, I want to activate it and set my own password, so that no one else knows my credentials.
• As an administrator who forgot my password, I want to reset it myself, so that I do not have to wait for someone else.
• As a security-conscious administrator, I want a second authentication factor, so that a stolen password is not enough to get in.
• As a new administrator, I want to understand the console layout, so that I can find any page quickly.

1. Signing in

Route: /auth/login

1. Open the Console URL in a browser.
2. Enter your Email and Password.
3. Select Sign in.

On success you land on the last dashboard page you visited, or the home dashboard if this is your first sign-in in this browser.

1.1 Only Console users may sign in here

The Console accepts User accounts (Console administrators) only. If you sign in with a Member account, the session is discarded immediately and you see an error saying member accounts cannot access the administration console. Members sign in at the Agentless Portal instead.

1.2 Sign-in errors

2. Activating a newly created account

When an administrator creates your account with the automatic password mode, you receive an activation mail instead of a password.

Route: /auth/setup (reached from the link in the mail)

1. Open the link in the mail. It carries a one-time token and your email address.
2. The Email field is filled in and read-only.
3. Enter New password and Confirm password.
4. Select the submit button. On success you are signed in and taken into the product.

The activation link is valid for one hour. After that, ask an administrator to resend it. Resending invalidates the previous link.

2.1 Password policy

The password you set here must satisfy all six rules. The rule list sits under the field and ticks off live as you type; the submit button stays disabled until every rule is met.

The same six rules apply to Change password in the Console and to the Reset password page, so a password that works in one place works everywhere.

Why the rules are enforced before you submit: the backend consumes the activation token before it validates the password. If a password were rejected server-side, the token would already be spent and the account would be stuck. The client therefore refuses to send a non-compliant password.

2.2 Activation failures

3. Forgot password

Route: /auth/forgot-password

1. On the sign-in page select Forgot password.
2. Enter your registered Email (max 255 characters) and submit.
3. You always see the same confirmation — “if this mailbox has an account, we have sent reset instructions” — whether or not the address exists. This is deliberate: it prevents the page from being used to discover valid accounts.
4. Open the link in the mail and set a new password on /auth/reset-password. The same six password rules apply.

The reset link is valid for one hour.

4. Multi-factor authentication (MFA / TOTP)

Merak uses time-based one-time passwords (TOTP) from an authenticator app such as Google Authenticator, Microsoft Authenticator or Authy.

4.1 Being asked for a code at sign-in

If your account already has an authenticator enrolled, sign-in runs in two stages: after email and password are accepted, a six-digit code prompt appears. Enter the current code from your app.

If the code is refused (wrong, or already spent), the prompt stays open with the field marked in error. Wait for the next code and try again — a TOTP code can be used only once.

4.2 Enrolling an authenticator during sign-in

If policy requires MFA for your account but you have never enrolled, sign-in opens an enrollment dialog instead:

1. Scan the QR code with your authenticator app, or copy the secret and type it in manually.
2. Enter the six-digit code the app now shows.
3. Submit. Enrollment completes and the same code is used to finish signing in.

Cancelling the dialog abandons the attempt cleanly — nothing is enrolled and the secret you were shown is discarded.

4.3 Turning MFA on or off yourself

Once signed in, you manage your own MFA from My Account. See 10 · My Account §4.

4.4 Resetting someone else’s MFA

An administrator with the right permission can clear another account’s enrolled authenticator — see Members §5 and Administrators & Roles §2.

5. The Console layout

Every signed-in page renders inside the same shell.

┌──────────────┬──────────────────────────────────────────────────────┐
│              │  App Header:  [icons] [Profile] [Preferences]  Tenant │
│  Left Aside  ├──────────────────────────────────────────────────────┤
│  (menu +     │                                                      │
│   search)    │                  Page content                        │
│              │                                                      │
└──────────────┴──────────────────────────────────────────────────────┘

5.1 The navigation menu

A menu entry you have no permission for is hidden, and a group whose every child is hidden disappears too. Typing a URL directly does not get you past this — the page shows a “no access” result and the menu still hides the entry.

5.2 Finding a page by search

The search box at the top of the left menu has two modes; the icon button inside the field toggles between them.

Both modes accept Chinese and English, and tolerate pinyin and small typos. Results respect your permissions: pages you cannot open never appear, and create / import entries additionally require the resource’s C permission.

5.3 The app header

Right of the icon row the header shows your tenant name and your account name. Both truncate with a tooltip carrying the full text. Two icon links sit in the row:

• Profile → /profile — see 10 · My Account.
• Preferences → /preference — theme, language, timezone, tables.

The icon of the page you are on is highlighted.

If your account holds no roles at all, the tenant name may be blank. That is expected — reading the tenant name needs tenant:R, and the page degrades gracefully rather than failing.

6. The dashboard

Route: / — visible to every signed-in account, no permission required.

The dashboard answers “what needs my attention right now”. Every tile is a link that opens the target list already filtered to the same slice it counts.

6.1 KPI tiles

6.2 Inventory

Total counts of Members, Applications and Merak Nodes, each linking to its list.

6.3 Recent activity

Two panels — the five most recent audit log entries and the five most recent approval requests — each with a View all link into the full list.

7. Signing out

Use the sign-out control in the app header. Signing out:

• clears your tokens in every open tab, not just the current one;
• revokes the refresh token on the server, so a copy of it cannot be used to mint new sessions afterwards;
• clears cached data.

Your session also ends on its own when the refresh token expires. When that happens you see one session-expired notice — no matter how many requests failed at once — and are returned to the sign-in page.

Next

• Set up your own account: 10 · My Account
• Start managing people: 02 · Members