Skip to main content
Version: Next

Guest / Demo User Mode

Guest (or "demo") mode lets unauthenticated visitors use Cortex Archive without signing in, by treating them as a nominated user account — the Demo User. This functions the same as if 'none' is specified for the Authentication Type, while allowing one additional authentication method as well. Visitors start as the demo user and can then sign in as a specific user at any time.

warning

Guest mode is intended for demonstrations, evaluations, and training. It is not intended for production or normal use.

Supported authentication types​

Guest mode can be enabled when the authentication type is Internal or SAML.

Authentication typeBehaviour for an unauthenticated visitor
InternalBrowses as the Demo User; the Sign In link opens the Cortex internal login page
SAMLBrowses as the Demo User; the Sign In link hands the visitor to your identity provider

Guest mode is not available with No Authentication (every visitor is already signed in), Windows Authentication, or OpenID Connect (Keycloak).

A SAML deployment that does not configure a Demo User is unaffected — visitors are prompted to sign in (or redirected to the identity provider) exactly as before.

Configuring the Demo User​

The account used as the Demo User should already exist in Admin > User Management — its security group and permissions determine what visitors can see in demo mode.

Option 1 - In-app (Admin)​

  1. Navigate to Admin > Authentication and set Type to Internal or SAML.
  2. In the Demo User field, enter the username of the account that visitors should demo as.

When the authentication type does not support guest mode, the Demo User field is disabled and a notice explains that it can only be used with internal or saml authentication.

Option 2 - appsettings.json​

Set OverrideUsername in the Authentication section:

{
  "Authentication": {
    "Type": "saml",
    "OverrideUsername": "demo.user"
  }
}

The equivalent environment variables are Authentication:OverrideUsername (Windows) and Authentication__OverrideUsername (Linux).

If the Demo User is set in appsettings.json or an environment variable, that value takes precedence over the in-app setting, and the in-app field is displayed read-only.

Behaviour​

When a Demo User is configured and the authentication type supports guest mode:

  • Unauthenticated visitors are automatically signed in as the Demo User and see exactly what that account can see. Demo mode does not grant administrator access or any extra rights — the Demo User's own security group decides.
  • A demo mode warning dialog is shown on entry, explaining that the system is configured in demo mode. It offers Sign In as a Different User and Don't Show Again; choosing Don't Show Again turns the warning off for the system.
  • The navigation footer shows Sign In in place of Log Out while the visitor is in demo mode.
  • A real authenticated session always takes precedence — demo mode never replaces an authenticated user.
  • Demo sessions are per-request: no persistent authentication cookie is issued, so a visitor who closes their browser starts a new demo session.
  • A single Demo entry per browser session is recorded in the user login history.

Signing in as a real user​

From the Sign In link in the navigation footer, or Sign In as a Different User in the demo mode warning:

  • With Internal authentication, the visitor is taken to the Cortex internal login page.
  • With SAML authentication, the visitor is handed to your identity provider to authenticate.

Either way, the visitor's authenticated session replaces the demo session.