Users and roles

Accounts live in the stack's own Keycloak (realm athena-security). Administrators manage them in the console; there is no separate directory to set up.

Create a user

Admin → Users → Create user:

Field	Notes
Username, e-mail, first and last name
Password	At least 12 characters, with upper case, lower case, a digit and a special character; not the username or e-mail
System administrator	Full access
Application access	Ageleia (the console), Pallas AI, Athena Core (the SIEM dashboard at /siem/)
Roles	Optional: Security Analyst, Security Viewer, or your own

There is no e-mail invitation: give the user their initial password yourself. Open the user and use Reset password with Require change at next login so they choose their own.

Users change their own password from the user menu (Change password).

Roles

Admin → Roles lists roles. Each role grants View or Edit per page. System roles (Admin, Security Analyst, Security Viewer) cannot be renamed; create your own for anything else.

Default grants:

Page group	Security Analyst	Security Viewer
Alerts, mutes, threat intel, policy engine, firewall, WAF, blocked IPs, active response, Pallas, Cloudflare, decoder lab, patching	Edit	View
Get started, agents, dashboards, compliance, vulnerabilities, investigation, platform health, AWS, Office 365, scanner	View	View
Users, roles, single sign-on, protected IPs, integrations, configuration, audit log	none	none

On the Compliance page, choosing frameworks and exporting the evidence pack are for administrators whatever a role grants.

The first administrator

The install creates one administrator (admin unless chosen otherwise) with a temporary password. To issue a new temporary password for it:

cd /opt/theseus && sudo ./theseus admin reset-password

Keycloak administration

Keycloak's own administration console is at https://<your domain>/auth/admin/, user admin, password KEYCLOAK_ADMIN_PASSWORD in theseus.env. You should not need it for everyday user management; changes there can break the console's sign-in.

Single sign-on

Admin → Single sign-on connects your organisation's identity provider (Entra ID, Okta, Google Workspace or any OpenID Connect provider). People then see Sign in with <name> on the sign-in page; your provider's MFA and access policies apply before they reach Theseus.

1. In your identity provider, register an app (web) with the redirect URI the page shows.
2. Add identity provider: a name for the sign-in page, the issuer URL (for Entra ID https://login.microsoftonline.com/<tenant id>/v2.0), the app's client ID and secret.
3. Choose the role people get the first time they sign in: Viewer or Analyst. Nobody becomes an administrator by signing in; change roles on the Users page.

Password sign-in keeps working alongside it. Turn off hides the provider from the sign-in page; Remove deletes it (people who used it keep their accounts).