Security¶
This section covers what 3forge Enterprise secures by default, how a user's identity is established, and how connections between components and clients are encrypted. Entitlements (what an authenticated user can see and do) and encryption at rest are not yet documented; see the gaps below.
In this section¶
- Security Defaults: the login prompt on first start, the keystores shipped in
keys/, the file-system sandbox, and mandatory mutual TLS at a glance. - Server Certificates: replace the shipped self-signed certificate, or trust it in a client.
- Mandatory Mutual TLS: the client-certificate requirement on the Center, JDBC, Relay, and Gateway listeners.
- Authentication: the 2 plugin mechanisms for checking who a user is, covering the shipped local-file default, LDAP, SAML, OAuth, and Okta.
- Gateway Security: authentication and TLS for Gateway listeners specifically, documented in the Gateway section because it uses its own listener configuration.
Start here¶
New to a deployment's security posture: start with Security Defaults, then Authentication to pick a login mechanism.
Overview¶
Access to 3forge Enterprise is controlled at 2 levels. Authentication establishes who a user is, through the shipped local access file or an external identity provider; see Authentication. Every secure listener other than the Web and WebSocket listeners also enforces mandatory mutual TLS, so a client must present a certificate as well as credentials; see Mandatory Mutual TLS. What an authenticated user can then see and do (entitlements) is not documented yet, below.