User Management

One-Click Least Privilege. Zero Disruption.

Inviting Users

Users can be managed by navigating to the Users tab within the lefthand menu.

To send the invitation, the user's email address and at least one role must be input into the form.

The Sonrai Cloud Permissions Firewall user invitation form showing fields for the user's email address and role assignment.

The Sonrai Cloud Permissions Firewall Users page showing the Pending User Invitations tab with a list of invited users awaiting acceptance.

Once sent, users will be listed in the "Pending User Invitations" tab until the invitation is accepted.

info

Only valid email addresses can be used with the Sonrai Platform. Addresses which cannot accept email are not supported (this applies to users utilizing local Sonrai authentication and external SSO integration)

Organizations are permitted to have up to 25 accounts by default (contact Support and the limit can be increased)

Automating User Invitations

Leverage the "Send Validation Email" setting at the top of the form to assist in automating user invitations.

Unchecking the "Send Validation Email" setting will not send a user validation email and it will hide the “CC myself on the email” checkbox.

info

If required, supplying invalid domains (Example: joe.smith@exampleinvalid.domain.testing) in general email address format [with "Send Validation Email" unchecked] is supported.

To script user invitation automation using GraphQL:

User Invitation Mutation
mutation createInvite {
  CreateSonraiInvites(
    input: {
      email: "joe.smith@exampleinvalid.domain.testing"
      name: "Joe Smith"
      ccInviterOnEmail: true
      expiryTimeInSeconds: 1143500
      sendEmail: false
    })
  {
    items{
      srn
    }
  }
}

Authentication & Password Policy

Single Sign-On (SSO)

If your organization has SSO configured and an IDP group has CPF role assignments, users in that group can log in without an invitation. See Login without invitations for details.

Password & MFA Token Resets

Authentication and password/MFA token resets are handled through your organization's SSO platform.

Local Sonrai Password/MFA

For users who have local passwords [i.e., are not leveraging SSO], password and MFA settings are managed by Sonrai's Auth0 password management.

Password Requirements

10 character minimum length
At least 3 of the following:
Lower case letters (a-z)
Upper case letters (A-Z)
Numbers (0-9)
Special characters ( ex.!@#$%^&*)
No more than 2 identical characters in a row
Previous 5 passwords cannot be reused

*Multi-factor authentication is required for local (non-SSO) users

Resetting Passwords

To reset a password:

Navigate to https://app.sonraisecurity.com/
Enter the user's email address
Click the "Forgot password?" link
Click and check the email inbox for the password reset link

The Sonrai platform login page showing the email address field and 'Forgot password?' link used to initiate a local password reset.

The Auth0 password reset email notification indicating that a password reset link has been sent to the user's email address.

*Check your spam folder if the email is not received within a few minutes!

The Sonrai platform password reset form showing a field for entering and confirming a new password after clicking the password reset link from the email.

Resetting MFA Tokens

Local (non-SSO) MFA token resets can only be completed through submitting a Support Ticket.

If a user enters their password incorrectly more than 10 times from a single IP address, they will be blocked from logging into that account from that IP address. This can block can be removed manually by Sonrai by changing your password, or by clicking the “Unblock” link in the email notification sent to the blocked account.

Reference: For more details on failed login monitoring & disabling, refer to Auth0 - Brute Force Protection documentation.

Changing the Default Invitation Timeout Period

By default, Sonrai user invitations are valid for 5 days, and afterwards, invitations must be resent. This default invitation expiration can be set to a larger value by using the following mutation in Explorer:

Standard timeout values for consideration include:

30 days -> 2592000
60 days -> 5184000
90 days -> 7776000
120 days -> 10368000
180 days -> 15552000

warning

Do not set the timeout value to exceed 6 months.

To view the current timeout value:

Example Query
Example Query Return

Example Query

Example Query
query getSonraiOrgConfig {
    SonraiOrgConfig {
        metadata
    }
}

Example Query Return

Example Query Return
{
  "data": {
    "SonraiOrgConfig": {
      "metadata": {
        "ui/preferences/analyticsWindowDays": "2",
        "ui/preferences/grantedDateGracePeriod": "3"
      }
    }
  }
}

To change the current value to a new one:

Example Mutation
mutation setOrgInviteDefaultExpiry {
    UpdateOrgConfigMetadata(metadata: [
    {
        keyName: "ui/preferences/defaultInviteTimoutDurationSeconds"
        keyValue: "7776000"
    }
    ]) {
        metadata
    }
}

Managing Users

Role Changes

Once a user has been added to the Sonrai platform, their assigned role(s) can be edited from the Current Users management screen (simply click on the name of the user in the table row).

Modifying Pending User Invitations

To manage a pending user invitation, select for the invitation. Alternatively, you can cancel or resend the invitation email.

The Sonrai Cloud Permissions Firewall Pending User Invitations tab showing the Edit Role Assignments, cancel, and resend options available for a pending invitation.

User Name Changes

A user's name can be changed through API calls, if needed.

Within the browser Developer Tools, navigate to the Network tab
Log in to your environment
Within the browser Developer Tools, click on one of the graphql calls, then the "Headers" tab. Within the Request Headers, copy the Bearer Token:

Browser Developer Tools Network tab showing a GraphQL request with the Request Headers section highlighted, indicating where to copy the Bearer Token for API authentication.

Using whichever method you like, submit a POST request for a GraphQL mutation similar to the following example:

Example Mutation
mutation UpdateSonraiCurrentUsers {
    UpdateSonraiCurrentUsers(input: { name: "newName" }) {
        count
        items {
            name
        }
    }
}

An API client (such as Postman) showing the GraphQL mutation response for updating a Sonrai user's name, with the returned updated name in the result payload.

Disabling Users

For audit purposes, users are not deleted from the Cloud Permissions Firewall.

Instead, we recommend users are terminated and the privileges removed from the user account.

This ensures that the user cannot login, and if for some reason the account was re-activated, that the user has no active permissions.

The Sonrai Cloud Permissions Firewall user management screen showing the option to terminate a user and remove their role privileges to disable their account.

Groups

Groups let you assign roles to multiple users at once instead of individually. A user's effective permissions are the union of any roles assigned directly to them and any roles assigned to groups they belong to. Groups are available whether or not your organization has SSO configured.

There are two kinds of groups in CPF: CPF-managed and IdP-synced.

Group type	Created by	Membership source	When to use
CPF-managed	Admin in CPF	Manually added and removed in CPF	Internal-only roles, contractors, or users who are not represented in your IdP
IdP-synced	Created automatically on first login (or via SCIM) when CPF sees a new group in the `groups` claim	The user's IdP group memberships, refreshed each login	The common case — mirror your IdP groups so CPF permissions follow your existing IdP membership management

The Groups tab

Groups are managed from the Groups tab on the Users screen, alongside Current Users and Pending User Invitations. The tab lists every group's name, description, assigned role(s), member count, and enabled state, and includes a quick search and a Show Terminated Groups toggle for viewing disabled groups.

Creating a group

Select to open the Manage Group dialog:

Name — select an existing group discovered from your IdP to map it into CPF as an IdP-synced group, or type a new name to create a CPF-managed group.
Description — optional.
Assign Role(s) — required; at least one role must be assigned.
Members — select to open a searchable dropdown of users and add them to the group.

Select to create the group.

The Sonrai Cloud Permissions Firewall Manage Group dialog showing fields for selecting or entering a group name, an optional description, required role assignment, and adding members.

Editing a group

Select a group's name in the list (or Edit from its row's overflow menu) to open the Edit Group dialog. From here you can update the description, add or remove role assignments, and add or remove members.

The Members table's Type column shows how each member's group membership originated — Local for members added manually, and SSO for members discovered through your IdP.

The Sonrai Cloud Permissions Firewall Edit Group dialog showing the group's name, description, assigned roles with scope and source, and its list of members with their membership type.

Assigning roles to groups

Roles are assigned to groups in the same way they are assigned to users. All members of the group inherit the role assignments. See User & Role Personas for the list of available CPF roles.

Terminating a group

Select Terminate from a group's row overflow menu to disable it. Terminating a group does not delete it — enable Show Terminated Groups to view previously terminated groups.

info

For groups synchronized from an identity provider — including group name matching and SCIM-based provisioning — see Group Synchronization in the Single Sign-on (SSO) documentation.

Viewing User Activity Logs

The Sonrai Cloud Permissions Firewall User Activity Log tab displaying a list of logged platform actions including user logins and configuration changes.

Sonrai user activity logging is available in the "User Activity Log" tab, with the following relevant Sonrai platform actions being logged:

UserLogin
UpdateSonraiUsers
UpdateSonraiCurrentUsers
CreateSonraiInvites
UpdateSonraiInvites
DeleteSonraiInvites

CreateSonraiPendingRoleAssignments
DeleteSonraiPendingRoleAssignments
CreateSonraiRoleAssignments
DeleteSonraiRoleAssignments
CreateSonraiRoles
UpdateSonraiRoles

CreateQueryvariable
CreateSavedquery
UpdateQueryvariable
UpdateSavedquery

Reviewing Older Actions

By default, the User Activity screen shows the last 7 days of user activity but can be readjusted to:

Last 24 hours
Last 7 days
Last month
Last 90 days
Last year
Custom

Using the Explorer, searches can also span back further and filtering for specific actions like listed above can be completed to determine the user(s) who made platform changes.

For example, the query below searches from December 1st, 2023 - January 01, 2024 to list any users who logged in:

Example Query
Example Query Return

Example Query

Example Query
 query sonrai_user_activity { SonraiAuditLogs
  	( where: {
        fromDate: { value: "2023-12-01"}
        toDate: { value: "2024-01-01"}
        eventName: {value: "UserLogin"}
     })
  {
  	count
    items {
      createdDate
      eventName
      actor { name }
      message
    }
	}
}

Example Query Return

The results will list:

the date the log entry was created (i.e. when the action occured)
the user who logged in to the Sonrai platform
and a message containing the Sonrai organization and user Id (should you need those finer details)

Example Output
{
  "data": {
    "SonraiAuditLogs": {
      "count": 14,
      "items": [
        {
          "createdDate": "2023-12-18T20:47:21.096+00:00",
          "eventName": "UserLogin",
          "actor": {
            "name": "user.name"
          },
          "message": "User srn:dev12335969::SonraiUser/54f473b5-171c-4c91-8e19-dde26cdb975f logged in"
        },
        .....

Inviting Users​

Automating User Invitations​

Authentication & Password Policy​

Single Sign-On (SSO)​

Password & MFA Token Resets​

Local Sonrai Password/MFA​

Password Requirements​

Resetting Passwords​

Resetting MFA Tokens​

Failed Login Attempts​

Changing the Default Invitation Timeout Period​

Example Query

Example Query Return

Managing Users​

Role Changes​

Modifying Pending User Invitations​

User Name Changes​

Disabling Users​

Groups​

The Groups tab​

Creating a group​

Editing a group​

Assigning roles to groups​

Terminating a group​

Viewing User Activity Logs​

Reviewing Older Actions​

Example Query

Example Query Return

Inviting Users

Automating User Invitations

Authentication & Password Policy

Single Sign-On (SSO)

Password & MFA Token Resets

Local Sonrai Password/MFA

Password Requirements

Resetting Passwords

Resetting MFA Tokens

Failed Login Attempts

Changing the Default Invitation Timeout Period

Managing Users

Role Changes

Modifying Pending User Invitations

User Name Changes

Disabling Users

Groups

The Groups tab

Creating a group

Editing a group

Assigning roles to groups

Terminating a group

Viewing User Activity Logs

Reviewing Older Actions