Super Administrator Guide - Multi-Tenant Management

Overview

This guide is for Super Administrators who manage the entire SSO Portal system, including multiple tenants and super admin accounts.

Accessing Support Portal

Login Process

1. Navigate to /support/login.php
2. Enter super admin username (not email)
3. Enter super admin password
4. Complete MFA if enabled
5. Access support portal dashboard

Important: Support portal is separate from regular tenant login

Security Features

• Separate authentication system
• Rate limiting (5 attempts per 5 minutes)
• CSRF protection on all forms
• MFA recommended for all super admins
• Enhanced audit logging

Tenant Management

Creating a New Tenant

Step 1: Access Tenant Management

1. From support portal, navigate to Tenants
2. Click Create New Tenant

Step 2: Configure Tenant

Fill in tenant details:

Tenant Identifier

• Unique slug (e.g., acme-corp)
• Lowercase, alphanumeric, hyphens only
• Used in login process
• Cannot be changed after creation

Company Name

• Full organization name
• Displayed in UI
• Example: "Acme Corporation"

Domain

• Company's primary domain
• Used for email validation
• Example: acme.com

Settings:

• JWT Secret: Auto-generated (for signing tokens)
• Session Timeout: Default 2 hours
• Require MFA: Force MFA for all users
• Max Users: License limit (optional)

Step 3: Create Initial Admin

Every new tenant needs at least one administrator:

1. Enter admin email address
2. Set temporary password
3. Configure:
   • Require MFA: Yes (recommended)
   • Send welcome email: Yes
4. Admin can log in immediately

Managing Existing Tenants

View Tenant Details

1. Tenants tab
2. Select a tenant
3. View:
   • Tenant info
   • User count
   • Application count
   • Last activity
   • Settings

Edit Tenant

1. Select tenant
2. Click Edit
3. Modify settings:
   • Company name
   • Domain
   • Session timeout
   • MFA requirement
4. Save changes

Cannot Modify:

• Tenant identifier (slug)
• JWT secret (can regenerate)
• Creation date

Regenerate JWT Secret

Warning: This invalidates all existing tokens for this tenant

1. Select tenant
2. Click Regenerate JWT Secret
3. Confirm action
4. New secret generated
5. All applications must update their configuration

Use Cases:

• Security breach
• Periodic rotation
• Compliance requirement

Deactivate Tenant

Temporarily disable a tenant:

1. Select tenant
2. Toggle Active status to Off
3. Confirm action

Effects:

• Users cannot log in
• Applications cannot authenticate
• Data preserved
• Can reactivate anytime

Delete Tenant

Warning: Permanent deletion of all tenant data

1. Select tenant
2. Click Delete Tenant
3. Type tenant identifier to confirm
4. All data removed:
   • Users
   • Applications
   • Audit logs
   • Settings

Before Deleting:

• Export data if needed
• Notify tenant administrators
• Document reason for deletion
• Back up audit logs

Tenant User Management

View Tenant Users

1. Tenants tab
2. Select a tenant
3. Click View Users
4. See all users in that tenant

Manage Tenant User

As Super Admin, you can:

• Reset user passwords
• Reset user MFA
• Change user roles
• Activate/deactivate users
• View user audit logs

Cannot:

• Log in as a tenant user
• View user passwords
• Modify user without audit trail

Cross-Tenant Operations

Allowed:

• View users across all tenants
• Compare tenant configurations
• Generate system-wide reports

Not Allowed:

• Share users between tenants
• Merge tenants
• Copy applications between tenants

Super Admin Management

Creating Super Admins

1. Super Admins tab
2. Click Create Super Admin
3. Enter:
   • Username (not email)
   • Password
   • Full name
4. Enable MFA: Recommended
5. Save

Security Recommendations:

• Require strong passwords
• Enforce MFA
• Limit number of super admins
• Use descriptive usernames
• Document access grant

Managing Super Admin Access

View Super Admins

1. Super Admins tab
2. See list of all super admins
3. View:
   • Username
   • Full name
   • MFA status
   • Last login
   • Active status

Edit Super Admin

1. Select super admin
2. Click Edit
3. Modify:
   • Full name
   • Password
   • Active status
4. Save changes

Reset Super Admin MFA

If super admin loses MFA access:

1. Select the super admin
2. Click Reset MFA
3. Confirm action
4. They must set up MFA again on next login

Deactivate Super Admin

Temporarily disable access:

1. Select super admin
2. Toggle Active to Off
3. Confirm

Effects:

• Cannot log in to support portal
• All sessions invalidated
• Audit logs preserved
• Can reactivate later

Delete Super Admin

Permanently remove super admin:

1. Select super admin
2. Click Delete
3. Confirm deletion
4. Account removed

Requirements:

• Cannot delete yourself
• Cannot delete last super admin
• Audit trail preserved

System-Wide Monitoring

Dashboard Overview

Support portal dashboard shows:

• Total Tenants: Active tenant count
• Total Users: Across all tenants
• Total Applications: System-wide
• Recent Activity: Latest audit events
• System Health: Status indicators

Audit Logs

View System-Wide Logs

1. Logs tab
2. Filter by:
   • Tenant
   • User
   • Action type
   • Date range
   • IP address

Export Audit Logs

1. Apply desired filters
2. Click Export
3. Choose format (CSV, JSON)
4. Download file

Use Cases:

• Compliance reporting
• Security investigation
• User activity analysis
• Trend analysis

Analytics

System Metrics:

• Login patterns by tenant
• Failed authentication attempts
• MFA adoption rate
• Application usage
• User growth trends

Backup and Recovery

Database Backups

Recommended Schedule:

• Daily incremental backups
• Weekly full backups
• Monthly offsite backups

What to Backup:

• Database (all tenant data)
• Configuration files
• Audit logs
• Application secrets (encrypted)

Disaster Recovery

Recovery Procedures:

1. Restore database from backup
2. Restore configuration files
3. Verify tenant integrity
4. Test authentication
5. Notify tenants if needed

Security Best Practices

Super Admin Security

• Enable MFA: Required for all super admins
• Strong passwords: 16+ characters
• IP restrictions: Limit access to known IPs (optional)
• Regular audits: Review super admin actions monthly
• Least privilege: Only create super admins when needed
• Session timeouts: Keep short (30 minutes recommended)

Tenant Security

• Enforce MFA: Recommend for all tenants
• Monitor activity: Check audit logs regularly
• Rotate secrets: JWT secrets annually
• Review access: Quarterly tenant reviews
• Deactivate unused: Remove inactive tenants

Incident Response

If Security Incident Detected:

1. Identify affected tenant(s)
2. Deactivate if necessary
3. Review audit logs
4. Regenerate compromised secrets
5. Notify tenant administrators
6. Document incident
7. Implement preventive measures

Maintenance Tasks

Daily Tasks

• Review dashboard for anomalies
• Check failed login attempts
• Monitor system health
• Respond to support requests

Weekly Tasks

• Review new tenants
• Check system resource usage
• Analyze audit logs
• Apply security patches

Monthly Tasks

• Full security audit
• Review all super admin accounts
• Analyze tenant growth
• Generate compliance reports
• Update documentation

Quarterly Tasks

• Comprehensive system review
• Tenant access audit
• Update disaster recovery plan
• Security training for super admins
• Review and update policies

Troubleshooting

Tenant Can't Log In

1. Verify tenant is active
2. Check user exists in tenant
3. Review tenant settings
4. Check audit logs for failures
5. Verify JWT secret is valid

Application Integration Issues

1. Verify application configuration
2. Check JWT secret hasn't been regenerated
3. Review redirect URIs
4. Test OAuth endpoints
5. Check tenant settings

Performance Issues

1. Check database performance
2. Review server resources
3. Analyze slow query logs
4. Check tenant usage patterns
5. Consider scaling if needed

Support Portal Features

Tenant Users View

See all users across all tenants:

1. Tenant Users tab
2. Filter by tenant
3. Search by email
4. View user details
5. Manage cross-tenant

System Logs

Comprehensive logging:

• All authentication events
• Configuration changes
• Super admin actions
• System errors
• Security events

Backup Codes Management

Manage super admin MFA:

1. View your MFA settings
2. Generate backup codes
3. Disable/re-enable MFA
4. Reset if compromised

Compliance and Reporting

Generate Reports

Available Reports:

• Tenant growth over time
• User authentication statistics
• MFA adoption by tenant
• Failed login attempts
• Application usage
• Security incidents

Compliance Documentation

Maintain Records:

• Tenant creation/deletion
• Super admin changes
• Security incidents
• Audit log exports
• System changes
• Backup verification

Best Practices Summary

For System Security

• Minimum number of super admins
• MFA required for all super admins
• Regular password rotation
• IP whitelisting (if possible)
• Comprehensive audit logging
• Regular security reviews

For Tenant Management

• Clear naming conventions
• Document tenant purposes
• Regular activity reviews
• Communicate with tenant admins
• Proactive monitoring
• Timely support

For Operations

• Automated backups
• Documented procedures
• Change management process
• Incident response plan
• Escalation procedures
• Regular testing