Authentication and sessions
Local bootstrap access, personal SSH-backed sessions and login-source behavior.
Bootstrap administrator
The local administrator exists for initial setup and full platform administration. The password is configured during setup or by the administration scripts and is protected by the local password-hashing implementation.
SSH-backed users
Personal SSH users authenticate by validating their supplied credentials against configured managed switches. Their passwords remain session-bound rather than becoming general inventory credentials.
Authentication source order
Platform settings can define a primary source plus fallbacks or use automatic selection. Portivo can try up to AUTH_MAX_SOURCES enabled candidates within the bounded global login window.
Session behavior
Portivo keeps one active personal access session per username, replacing older in-memory tokens on a fresh login. Session cookies are HttpOnly and SameSite=Strict; they become Secure when PUBLIC_URL_SCHEME=https.
Authentication sequence and throttling
Installation creates a local bootstrap administrator. Network users authenticate through configured switch sources with personal SSH credentials; roles and scope are loaded from Portivo access-control records.
Authentication has per-source connection bounds and a global deadline. Progressive throttling delays repeated failures before they reach local or SSH-backed sources. A fresh login replaces an older in-memory session for the same username.
Password handling
Personal SSH passwords are encrypted only in process memory for the active session. They are not stored as device credentials, written to Jobs or exported in audit history.