Administration

Use the administration pages to give users access and review account activity. If a page or action is missing, sign in with an account authorized for that operation.

After signing in, Lens opens the highest page in the sidebar that your permissions allow, including combined or custom role permissions. Sidebar ordering, not the role name, determines this landing page. If no pages are accessible, Lens shows an access-denied message. Refreshing an existing signed-in session preserves a valid page URL and its filters; a fresh sign-in starts at the landing page instead.

Create a user

1. Open the Users page.
2. Click Add user.
3. In the Add user drawer, fill in Username, Display name, Email, Password, and Confirm password.
4. Optional: in Roles, preselect one or more roles.
5. If you assign roles and want cluster scope, change Scope from All clusters (global) to Specific cluster, then choose Cluster.
6. Click Add user.

Assign or remove a user's roles

1. Open the Users page.
2. In the user's row, click the action titled Roles.
3. In the Roles drawer, choose a Role.
4. Set Scope to All clusters (global) or Specific cluster.
5. If you chose Specific cluster, select a Cluster.
6. Click Add role.
7. To remove a binding later, click Remove role next to that entry.

Reset a user's password

1. Open the Users page.
2. In the user's row, click the action titled Reset password.
3. In the Reset password dialog, enter the New password and Confirm new password. Both values must match.
4. Click Reset password.

Create a group and manage members

1. Open the Groups page.
2. Click Add group.
3. In the Add group drawer, fill in Name and Description.
4. Optional: assign initial Roles, and if needed switch Scope to Specific cluster and choose Cluster.
5. Click Add group.
6. Back on the Groups table, click Members for the group you want to update.
7. In Group members, use Search members… to find users, select users with the checkboxes, or use Select all and Clear.
8. Click Save members.

Create or edit a role

1. Open the Roles page.
2. To create a role, click Add role. To change an existing custom role, click the action labeled Edit followed by the role's name.
3. In Add role, enter Name and Description if you are creating a new role.
4. In the permissions list, select the permission checkboxes you want the role to grant.
5. Click Add role for a new role, or Save permissions when editing an existing one.

Configure an identity provider

1. Open the Identity providers page.
2. Click Add provider.
3. In Add identity provider, fill in Name, Server URL, User base DN, Group base DN (optional), User filter, Username attribute, Display name attribute, Email attribute, Bind DN, and Bind password as needed.
4. Turn Enabled on or off.
5. Optional: select Default provider.
6. Click Add provider.
7. To verify connectivity later, click Test in the provider's row.
8. To modify an existing entry, click the action labeled Edit followed by the provider's name, update the fields, then click Save changes.

Import directory users and groups

Configure and test the identity provider before importing its users and groups.

1. Set Group base DN on the provider (for example ou=groups,dc=example,dc=org).
2. On the Identity providers page, click Sync in the provider row to import every group under that base and its members.
3. Sign-in also imports the user and their groups, so a directory user appears in Users after their first login.
4. Open Users or Groups to assign roles. Change directory group membership in your directory, not in Lens.
5. In Model services, open a model's Manage access drawer and grant inference to the imported user or group. The recipient must also have inference permission in that model's cluster; deployment sharing is no longer supported.

Deleting an identity provider also removes the accounts and groups it imported, including their role assignments and shares. Review affected users before deleting it.

Manage the master key

The master key protects stored provider credentials, such as LDAP bind passwords.

1. Open the Master key page.
2. Review Source, Key fingerprint, Key length, Provider secrets encrypted, and Previous keys retained.
3. Click Rotate key. Leave the new-key field blank to generate a key, or enter at least 16 characters, then confirm Rotate key.
4. Test the configured identity providers after rotation. Keep previous keys until you have confirmed they are no longer needed.
5. To remove old keys, click Clear previous keys and confirm.

When LENS_SECRET_KEY is provided through the environment the page is read-only: update the variable and restart Lens to rotate it.

Revoke an active session

1. Open the Active sessions page.
2. Review the Your sessions table columns: User, IP, Source, Created, Last seen, and Expires.
3. In the session row you want to end, click Revoke session.
4. Wait for the confirmation banner Session revoked.

Filter the audit log

1. Open the Audit log page.
2. Use All events to narrow the Event filter.
3. Use All results and All actions to narrow the result and action.
4. Use All sources to distinguish browser, API, assistant, background, and system events.
5. In Filter by user…, choose a username.
6. Optional: set Start and End with Start time and End time.
7. Click Clear Filters to reset the current filters.
8. Use Rows per page and the pager to move through the Events table. Each row shows the event, action, actor, source, result, and target.

Related reference

For the permission model behind these pages, see Auth and RBAC.