Introduction

Users are the people (and automation clients) that sign in to CTFreak. Every user belongs to exactly one auth provider, which determines how the user authenticates and where the account comes from:

Auth provider How the account is created How the user signs in
Internal users By an administrator, in People → Users → New user Username and password
OpenID Connect provider Automatically, on first successful login Redirected to the identity provider (SSO)
OpenID Connect provider with SCIM provisioning Pushed beforehand by the identity provider Redirected to the identity provider (SSO)

Note: The FREE edition is limited to 3 users, see Licensing.

User attributes

  • Full name: displayed throughout the UI. Set by an administrator for internal users, taken from the identity provider for external users (and refreshed at each login).

  • Administrator: grants full access to CTFreak, see Roles.

  • Enabled: a disabled user can neither sign in nor use their personal access tokens. The same applies to every user of a disabled auth provider.

  • Managed by: Internal for users whose lifecycle is driven from CTFreak, SCIM for users provisioned by an identity provider, which are read-only in CTFreak.

Managing users

Administrators manage users in People → Users. Each user page lists the teams the user belongs to and the roles the user holds on projects.

  • New user: creates an internal user with its full name, username, password, and administrator and enabled flags. External users are never created by hand.

  • Edit: for internal users, every attribute including the password. For external users, only the administrator and enabled flags (only the administrator flag for SCIM-managed users, whose name and enabled state are driven by the identity provider).

  • Edit teams: sets the internal teams the user is a member of.

  • Delete: removes the user along with its team memberships and project roles. SCIM-managed users can only be deleted by their identity provider.

Important: CTFreak always keeps at least one enabled internal administrator, so that access to the instance never depends on an external identity provider being available. The last one cannot be deleted, disabled or demoted.

Profile

Every user, whatever their roles, can open Profile from the menu to: