Identity & Access Overview
MASS uses a certificate-based identity model. Every user, machine, or service that accesses storage has a registered identity backed by a TLS certificate.
Authentication​
Clients authenticate to storage with mutual TLS. The certificate's Common Name is the lookup key for the matching identity.
Sign-in sources are configured under Identity & Access → Auth Settings, where you also set the order in which they are tried at login:
| Source | Notes |
|---|---|
| Local | Accounts created in the Dashboard, managed by the MASS certificate authority |
| LDAP | Generic LDAP directory (OpenLDAP, Active Directory, Google Secure LDAP). Users and groups sync from the directory. |
| OIDC | OpenID Connect provider, including Google OIDC |
A user who signs in from a directory or OIDC source appears in MASS automatically on first successful login.
Authorization​
Authorization is two-layered:
- Role — what administrative API operations the identity may perform
- Access policy — what data permissions the identity has on storage
Both are managed under Identity & Access: roles and policies live on the Access Rules page, on the Roles and Storage Access tabs.
Roles​
Eight built-in roles cover the common cases, and you can define custom roles for a unique permission combination. See Roles Reference.
A user's effective roles include everything inherited through group membership. Role and scope changes take effect immediately.
Access Policy Scopes​
system-wide
└── volumegroup (applies to every volume in the group)
└── volume (applies to a single volume)
A member with no access policy has no data access. A policy targeting a group applies to
every member of that group.
Permission levels are Read, Write, Read / Write, and Admin.
Each policy shows a Sync Status — SYNCED, SYNCING, or FAILED — indicating whether it
has been applied to the storage backend.
A role scoped to specific volume groups also limits what the identity can see: a scoped viewer lists only those volume groups and their volumes.
Identity Lifecycle​
ACTIVE → REVOKED
- Active — normal operating state. A newly created identity, and a newly registered machine, is active immediately; there is no approval step.
- Revoked — the identity can no longer authenticate. To restore access, delete the identity and create (or re-register) it again.
Identities can also be deleted outright, which is permanent.
The last active super_admin cannot be deleted, revoked, or demoted — the request is rejected
with a clear error so the system cannot lock everyone out.