Tokens, Auth & RBAC
Antemure separates machine identity (how a daemon proves itself to the hub) from human identity (how an operator signs in). This page covers every token type, the four-role RBAC model enforced identically at the hub, MCP and SOAR, multi-tenancy, and the credential vault.
Zero-touch enrollment
A daemon authenticates to the hub by enrolling outbound-only. It reads a join token (from antemure-enroll.json, or AURA_ENROLL_URL+AURA_ENROLL_TOKEN) and POSTs machine id / hostname / platform to the public POST /api/enroll. The hub constant-time-compares the join token (fleet-wide or per-tenant), binds the node to a tenant, find-or-creates the node id (idempotent on machine id), and returns a node API token, the license key and the hub URL. State is persisted 0600. It self-heals: a 401/403 clears state and re-enrolls from the join token.
Token types
| Token | Form | Role |
|---|---|---|
| Join / enrollment token | ej_… | Bootstrap secret for /api/enroll; fleet-wide or per-tenant; rotatable. |
| Node API token | nt_… | Operational fleet secret — the daemon's mutating-route bearer and its hub device bearer (config pull, relay, heartbeat). Rotatable from Admin. |
| License key | cp_… | Access8 entitlement; also the default gateway bearer. |
| Session cookie | antemure_session | HMAC-SHA256-signed {sub,email,role,org,exp} issued by WorkOS SSO or local login. |
| Service secrets | env | AURA_SOAR_PROXY_SECRET, AURA_INTEGRATION_INGEST_SECRET, AURA_DEVICE_EVENT_SECRET on internal routes. |
| SOAR command signing key | env | AURA_SOAR_COMMAND_SIGNING_KEY — HMAC over a canonical command string, verified before a SOAR dispatch executes on a node. |
RBAC roles
Four ordered roles: Viewer < Operator < Admin < SuperAdmin, mapped from WorkOS/AD group slugs (an unknown group maps to least privilege). The same matrix is enforced at the hub, the MCP server and SOAR.
Permission matrix
| Role | Can do |
|---|---|
| Viewer | All reads — fleet, incidents, metrics, knowledge graph, inspect endpoints. |
| Operator | Approve/deny/dispatch remediation, hunt, respond, analyst chat, ignore incidents, configure integrations, remediate alerts. |
| Admin | Fleet config & autonomy, vault writes, alert rules, deploy/upload, apply updates, SOAR playbooks, user management, PATCH/DELETE of endpoints. |
| SuperAdmin | Tenancy mode and cross-tenant administration. |
Public (no auth): /api/enroll, /api/health, /api/signup, /auth/*, static assets. With no SSO configured the hub runs in open mode and treats every request as operator with a banner.
SSO & multi-tenancy
Production auth is WorkOS AuthKit SSO (/auth/login → /auth/callback), configured with WORKOS_API_KEY, WORKOS_CLIENT_ID, WORKOS_WEBHOOK_SECRET, AURA_AUTH_COOKIE_SECRET and AURA_AUTH_REDIRECT_URI; a local-login fallback and a superadmin allowlist (AURA_SUPERADMIN_EMAILS) exist. Set AURA_TENANCY_MODE=multi for multi-tenant operation — a session may only touch nodes in its SSO organization's tenant, and enrollment binds each node to a tenant.
Vault
Admin-stored credentials (SSH keys, passwords, API tokens) are encrypted at rest with AES-256-GCM; the master key is AURA_VAULT_KEY (64 hex) or an auto-generated 0600 key file. Secret values are write-only — never returned over the API, never sent to the LLM, never logged; only metadata is readable. SOAR adapters resolve vault:<name> refs inside Temporal activities so plaintext never enters workflow history.
Crypto
HMAC-SHA256 for sessions, webhooks and SOAR commands; AES-256-GCM for the vault; SHA-256 for content hashes; BLAKE3 for stable entity ids; constant-time comparison for token checks. TLS is rustls (no OpenSSL).