Groupings
Integrators
Not loaded
Create integrator
Integrators
Fresh from the directory
Select an operation
Open a tray item to load its current data and controls.
Groupings
Dashboards
Not loaded
Create dashboard
Dashboards
Endpoint sets and owning integrators
Set dashboard intermediate
A dashboard references one intermediate. This direct change is allowed only while the dashboard has no active certificates; commissioned replacements use the rotation or compromise workflow.
Groupings
Smart Groups
Not loaded
Dashboard groups
Derived live from dashboard assignments. Every dashboard automatically provides a Dashboard: Friendly Name smart group, so there is no separate membership list to maintain.
Smart Groups
Dashboard grouping summaries
Groupings
Roles
Not loaded
Code-recognized access controls
Role definition names are labels only; they do not activate special behavior.
- Super administrator
users.is_super_admin - Bypasses permission checks and is required for kiosk and dashboard catalog creation, bundle catalog and group creation, bundle file upload, PSK authorization, root command queueing, PGP key association, and site-owner SSO.
- Site owner integrator
integrators.is_site_owner - Users in this integrator may configure non-site-owner SSO when they also have
configure_sso. Only a super administrator may configure the site owner itself. - Permission delegator
users.delegate_permission - May grant only a subset of their own permissions to users in the same integrator.
- Kiosk assignment
assign_to_integrator - Allows creation and application of a signed request that assigns a kiosk to an integrator.
- SSO configuration
configure_sso - Works only with the site-owner rule above; it does not allow configuration of the site owner.
- Bundle deployment assignment
assign_bundle_deployments - Allows signed kiosk membership and per-type release selection for bundle deployment groups.
- Dashboard assignment
assign_dashboards - Allows a signed request to replace the one dashboard endpoint set assigned to a kiosk.
Role Definition
Roles
Fresh from the directory
Groupings
Bundle Types
Not loaded
Create bundle type
Bundle Types
Fresh from the catalog
Groupings
Bundle Deployment Groups
Not loaded
Create deployment group
Link kiosk
Creates a protected request. Complete it under Request Signing.
Select bundle release
The selected release replaces this group's current release for the same bundle type after signature verification.
Bundle Deployment Groups
Kiosks and one release per bundle type
Entries
Customers
Not loaded
Create customer
Customers
Fresh from the directory
Entries
Users
Not loaded
Create user
Users
Fresh from the directory
Entries
Kiosks
Not loaded
Create kiosk
Assign kiosk to integrator
This creates a protected request. Open Request Signing to copy its message and complete the assignment with an authorized signature.
Assign kiosk to dashboard
This replaces the kiosk's one dashboard endpoint set after completion under Request Signing.
Kiosks
Fresh from the directory
Entries
Bundle Releases
Not loaded
Create bundle release
Bundle Releases
Fresh from the catalog
Details
Kiosk details
Not loaded
Add MAC address
Add integrator note
Kiosks
Hardware IDs, customer, and notes
Autoconf bootstrap and command operations
Authorize PSK bootstrap
Queue root command
Details
Request Signing
Not loaded
Submit signature
Pending requests
Awaiting a valid signature
Details
Set PGP Key
Not loaded
Associate PGP key
PGP keys
Associated users and authorized actions
Details
Bundle Files
Not loaded
Upload bundle file
Uploads are stored privately with their SHA-256 digest. Uploading does not authorize kiosk activation.
Bundle Files
Private catalog metadata
Details
Private PKI
Not loaded
Private PKI manages intermediate certificates independently. A dashboard references one intermediate from the Dashboards workspace; that intermediate issues the dashboard M3S app certificate and certificates for its kiosks. The root private key stays on the YubiKey and offline. Autoconf stores the public trust chain and the online intermediate key. Kiosks create their own keys and submit only CSRs.
If a root or intermediate is compromised, revoke and reissue its leaves, replace the affected trust material, and deliver recovery through the public-cert-TLS protected RPC path.
1. Create intermediate
Defines an intermediate independently. Dashboards reference this record; neither the dashboard nor this record represents a root.
2. Prepare online intermediate
Download the offline-signing configuration, then generate the replaceable intermediate key inside protected Autoconf storage. Only its CSR leaves Autoconf.
3. Activate offline-signed intermediate
Upload the signed intermediate plus its issuer trust anchor as public chain-verification material. Autoconf verifies the issuer self-signature, intermediate chain and constraints, and that the intermediate matches its protected key. Dashboards reference the activated intermediate, never the root.
Issue M3S server certificate
The CSR common name must match the dashboard M3S hostname. Autoconf fixes the SAN to that hostname and issues a serverAuth-only leaf.
Intermediates
Independent commissioning records and their optional dashboard references; no root keys
Details
Configure SSO
Not loaded