Role-based access control & SSO

Suricatavel includes a robust Role-Based Access Control (RBAC) system alongside Single Sign-On (SSO) integration. This ensures that security teams can securely access the platform with fine-grained control over visibility and actions.

---

User roles hierarchy

Suricatavel defines four built-in user roles, each representing a distinct privilege level. These roles determine access to menu sections, resources, actions, and API endpoints:

Role	Level	Description	Key Permissions
Administrator	40	Full administrative control.	Manage settings, users, custom roles, policies, SIEM forwarders, and templates.
Operator	30	Active network and infrastructure operations.	Manage firewalls, execute block/unblock actions, and provision/upgrade host agents.
Analyst	20	Security monitoring, incident triage, and rules.	Manage alerts, events, threat intelligence IOCs, and Suricata rules/feeds.
Viewer	10	Read-only observation.	View dashboards, alerts, events, and topology mapping (no modification permissions).

Note

Only users with the Administrator role can view, assign, or edit user roles in the Admin Panel.

---

Single Sign-On (SSO) integration

Suricatavel supports Single Sign-On (SSO) authentication using Google and Microsoft identity providers.

Configuration

To enable SSO, define the corresponding client credentials and redirect URIs in your .env configuration file:

# Google SSO Configuration
GOOGLE_CLIENT_ID=your-google-client-id
GOOGLE_CLIENT_SECRET=your-google-client-secret
GOOGLE_REDIRECT_URI=https://your-suricatavel-domain.com/auth/sso/callback/google

# Microsoft SSO Configuration
MICROSOFT_CLIENT_ID=your-microsoft-client-id
MICROSOFT_CLIENT_SECRET=your-microsoft-client-secret
MICROSOFT_REDIRECT_URI=https://your-suricatavel-domain.com/auth/sso/callback/microsoft

Once these variables are set, Google or Microsoft login buttons will automatically appear on the Suricatavel login screen.

New user provisioning & default role

When a user logs in via SSO for the first time:

1. Suricatavel checks if a user with that email or SSO ID already exists.
2. If no matching user is found, the system automatically provisions a new user profile.
3. By default, newly provisioned SSO users are assigned the Viewer role (the safest default).
4. Administrators can subsequently elevate the user’s role from the Administration > Users management resource.