Accounts and security

This chapter covers who can sign in to DroneTracker and what they can do: roles, user accounts, passwords, two-factor authentication, single sign-on, sessions, and trusted handheld devices.

Admins can change everything described here. Auditors can open every admin page, but they can’t change anything. While an auditor is signed in, the admin console header reads Auditor — read-only.

Roles

Every account holds one or more roles. DroneTracker ships with six system roles. You can’t edit or delete them. On Admin → Access → Roles they carry a ⚿ System tag.

Higher roles include the rights of lower ones: super_admin > admin > operator > analyst > viewer. auditor stands apart. It includes viewer, plus read-only access to the admin console.

Custom roles

If the system roles don’t fit, build your own:

1. Open Admin → Access → Roles.
2. Click + Add role.
3. Enter a Role name and an optional Description.
4. Tick the permissions the role should grant.
5. Save.

Custom roles appear under Custom roles, with Edit and Delete links. If you delete a role, every user who holds it loses its permissions. The confirmation tells you how many users that affects.

The support role

You may see a DroneTracker support account in the Support Access history. It exists only while you have a support invite open. You can’t assign the support role to anyone. See Support and ideas.

Users

Open Admin → Access → Users. The table lists every account: local accounts, SSO accounts, and accounts created by your identity provider (SCIM). For each account you see the Username, Display name, Email, Auth type, Roles, Groups, and Status.

Status is one of:

• Active: the user can sign in.
• Locked: too many failed sign-ins. The lock lifts by itself after the lockout period (see Sessions and sign-in limits).
• Inactive: the account was deactivated.

Add a user

1. Click + Add user.
2. Enter a Username and a Display name. Email is optional.
3. Set an Initial password, or leave it empty. If you leave it empty, the user must register a passkey the first time they sign in.
4. Under Roles, pick one or more roles.
5. Click Create.

Edit or deactivate a user

• Click Edit to change the display name, email, roles, or the Active switch.
• Click Deactivate to stop a user from signing in. DroneTracker never deletes accounts. A deactivated account stays in the list, so the audit trail stays complete.

Groups

Use Admin → Access → Groups to give roles to a set of users at once. Each group has a Group name, its Members, and its Mapped roles. Groups that come from your identity provider are kept in sync through SCIM or single sign-on. Local groups are managed entirely on this page.

Passwords

By default, a password must be at least 12 characters long. You can’t reuse any of your last 5 passwords.

To change your own password:

1. Open Admin → My Security (under Account).
2. In Change Password, enter your Current password, then the New password twice.
3. Click Change Password.
4. DroneTracker asks you to confirm with your second factor (see Step-up confirmation). After that, the change goes through by itself.

Changing your password signs you out everywhere, including the current browser. Sign in again with the new password.

If a user forgets their password, contact DroneTracker support (Admin → Support Access).

Two-factor authentication

Every account needs a second factor. If you sign in without one, DroneTracker makes you set one up before you can continue.

You can use either or both of these:

• Authenticator app (TOTP). An app such as 1Password, Authy, or Google Authenticator shows a 6-digit code that changes every 30 seconds.
• Passkeys (WebAuthn). A security key (for example, a YubiKey) or your device’s built-in passkey. Passkeys resist phishing, so use one if you can.

Manage your second factors on Admin → My Security.

Set up an authenticator app

1. In Authenticator app (TOTP), click Enroll TOTP.
2. Scan the QR code with your app. If you can’t scan it, type in the code shown under Manual entry.
3. Open Backup codes — save these now. Store the codes somewhere safe, then tick I have stored these codes in a secure location.
4. Enter the 6-digit code from your app and click Activate.

Each backup code works once. Use one if you lose your phone.

Other controls in this section:

• Rotate backup codes issues a new set. Every old code stops working. The new codes are shown once only.
• Disable TOTP turns the authenticator off. You must enter a current 6-digit code. Your backup codes are wiped as well.

Register a passkey

1. In Passkeys (WebAuthn), type a Name (optional), such as “YubiKey 5 NFC”.
2. Click Register passkey, then follow your browser’s prompt. Touch your key or confirm on your device.
3. If DroneTracker shows recovery codes, save them. They are the only way back in if you lose every passkey, and they won’t be shown again.

Each passkey shows a tag:

If DroneTracker warns that a passkey may have been cloned, delete it and register a new one from your main device.

Signing in with a second factor

After your password, DroneTracker shows Second factor required:

• With a passkey, click Verify with passkey.
• To use your app instead, click Use authenticator code instead and enter the 6-digit code.
• If you lost your passkey or phone, click Lost your passkey? Use a backup code or Use backup code instead.

If you lose your authenticator

1. Sign in with a backup code, or with another passkey you registered.
2. Open Admin → My Security. Remove the lost method and set up a new one.

If you have no backup code and no other passkey, you can’t sign in by yourself. An admin can’t remove your second factor from the console either. Ask another admin to contact DroneTracker support: open Admin → Support Access and choose the support type Accounts, access & security.

Step-up confirmation

Admin work needs a recent proof of your second factor. When you open the admin console, or save a change, and your last proof is too old, DroneTracker shows Re-authenticate to continue:

• click Use passkey, or
• enter a 6-digit authenticator code or a backup code, then click Verify.

The action you started then continues by itself.

By default a proof lasts 30 minutes. Changing your password always asks for a fresh proof. Installing an update or changing a trusted device may also ask for one.

Sessions and sign-in limits

These limits are set under Admin → System Settings → Authentication:

Notes:

• Changes on this page are saved right away, but they take effect after the next restart.
• Some rows can be pinned by the install. If a row says the install value wins, the value you save stays inactive. Contact DroneTracker support to change it.

Single sign-on (SSO)

DroneTracker can sign users in through your identity provider, using OIDC (OAuth2) or SAML 2.0.

1. Open Admin → SSO Providers.
2. Click + Add provider.
3. Under General, enter a Display name and choose the Provider type: OIDC / OAuth2 or SAML 2.0.
4. Fill in the provider details:
   • OIDC: Issuer URL, Authorization endpoint, Token endpoint, JWKS URI, Userinfo endpoint (optional), Client ID, Client secret, and Scopes (space-separated).
   • SAML: IdP Entity ID, SSO URL (IdP SingleSignOnService), SLO URL (optional), NameID format, IdP X.509 certificate (PEM), Sign AuthnRequests, and Allow IdP-initiated login (legacy).
5. Optional settings:
   • Default email domain (optional), for example acme.com, so users type only the part before the @.
   • Auto-provision users on first login.
   • Default provider (pre-selected on the login page).
   • Group mapping (JSON, optional). This maps your identity provider’s groups to DroneTracker roles, for example {"dronetracker-admins":"admin","ops":"operator"}.
6. Save.

Each active provider shows up as a sign-in button on the login page. Client secrets are encrypted at rest.

Admin → Access → SCIM has the steps for letting your identity provider create, update, and deactivate accounts and groups by itself. It also lists each provisioning event.

Trusted devices (handhelds and phones)

The Android handheld and the iPhone app’s Rig view sign in with a device certificate. A device enrolls by itself the first time it completes a full password and second-factor sign-in. After that it signs in without a password, both when it starts and whenever a session runs out.

On the iPhone, the certificate’s key stays in the phone’s keychain and never leaves the phone. The iPhone trusts the rig’s device sign-in certificate by the fingerprint the rig gave it while you were signed in, so it doesn’t ask you to confirm one.

Open Admin → Access → Trusted Devices to see every enrolled device. The page lists the Device, Operator, Status (Trusted, Expired, or Revoked), Last Login, and Expires date.

At the top, the page shows the rig’s Device sign-in certificate fingerprint. The first time a handheld connects, it asks the user to trust a fingerprint. That fingerprint must match the one shown here. If they don’t match, don’t trust it. Contact DroneTracker support.

If a device is lost or stolen, you have two choices:

Click Location to see where a device last reported from. Beacon and Revoke may ask for step-up confirmation.

For the operator side of handhelds, see Handheld and game controllers.