Skip to main content
Version: 3.2

Internal Authentication

Internal authentication uses manually managed user accounts stored within Cortex itself. This is useful when SSO is not available or not required.

First Login​

When you first enable Internal authentication, sign in using the built-in administrator account:

  • Username: cortex.admin
  • Password: cortex.admin

You will be prompted to change the password immediately on first login.

From there, navigate to Admin > User Management to add any additional accounts.

Guest / Demo User Mode​

Cortex supports a guest/demo login mode layered on top of Internal authentication. This allows unauthenticated visitors to browse Cortex as a demo user without needing to log in, while real user authentication remains available for full access.

How It Works​

  1. Set Authentication to Internal in the installer or Admin → Authentication.
  2. Navigate to Admin → Authentication → Settings.
  3. Enter a username in the Demo User field (the demo user account must exist in User Management).

When configured:

  • Unauthenticated visitors are automatically signed in as the demo user
  • A warning dialog is shown once per session to indicate demo mode (dismissible)
  • The navigation footer shows a Sign In link so visitors can log in as a real user
  • Once a real user logs in, the demo session is replaced by the authenticated session

The demo user has the same permissions as a regular Internal user — any data the demo user account can see is what visitors in demo mode will see. No special admin access is granted.

Limitations​

  • Demo sessions are per-request (no persistent cookie), so visitors who close their browser will need a new session
  • The setting can be configured via appsettings.json (Authentication__OverrideUsername) or through the web UI; the appsettings.json value takes precedence and cannot be overridden from the UI

Managing User Passwords​

From the User Management page you can set a user's password by editing their account. You can also check the box to force them to change their password on next login, which gives them the same password reset prompt you saw when first logging in.

As a best practice, when resetting a user's password, set it to a temporary value you can share with them and check the box to force a reset on their next login.

note

At this time, users cannot reset their own password if they are unable to log in. An admin user must reset it for them from the User Management page.

Disabling the cortex.admin Account​

The cortex.admin account cannot be permanently deleted — if removed, it will be recreated the next time the application starts.

If you want to prevent it from being used after setting up your other accounts, set its password to something unknown and leave it in place.

note

A future version will add the ability to disable specific user accounts without deleting them, including the built-in cortex.admin account.