The WebFrolic console, end to end

1. Console tour

What is WebFrolic?

An enterprise identity platform that combines customer identity (CIAM), workforce SSO, multi-tenant organisation management, RBAC and a built-in help desk in one console.

Who uses which console?

Administrators configure identity; support agents work tickets; employees self-serve access; every person manages their own account.

What protocols are supported?

SAML 2.0, OAuth 2.1 authorization code with PKCE, OpenID Connect, machine-to-machine client credentials, and SCIM for directory sync.

How is access decided?

Resources define what exists, scopes define the actions, roles bundle scopes, and groups carry roles to people.

Every console shares one shell: a dark top bar, a left navigation rail, and a content area with a heading band. Learn the shell once and the rest of the product is navigation.

1. The rail lists the sections you may open. Groups such as Configuration and Authorization expand in place; the item for the page you are on is highlighted.
2. The switchers sit top right. Dashboard moves between the administrator, help desk, employee and account consoles. Role changes which role you are acting in.
3. The tab strip under the page title holds the sub-pages of the thing you opened — a user, a role, an application.
4. The content area is a stack of cards. Primary actions sit in the card header, destructive ones are outlined in red.

2. Administrator console

The administrator console is where identity is configured: who may sign in, how they prove who they are, and what they may reach afterwards. Open it from Dashboard ▾ → Administrator.

2.1 Configuration — how do I set up email, SMS and branding?

What it is. Site-wide settings for the identity provider itself: how people are onboarded, what the sign-in pages look like, and how messages leave the system.

Where. Rail → Configuration. The group expands into seven top-level pages. Several pages contain deeper settings for tenancy, sessions, security, recovery, mobile behavior, user lifecycle, SCIM attribute mapping and tenant or SCIM token firewalls.

Setting up an email provider

Administrator → Configuration → Email Settings Live console

12

1. 1Configuration expands into seven pages.
2. 2Five tabs; Test Domains keeps rehearsal mail out of real inboxes.

1. Open Configuration → Email Settings and stay on the Providers tab.
2. Choose your provider — SMTP, SES, SendGrid, Mailgun, Postmark, Resend or Cloudflare — and press Edit.
3. Fill in the credentials. Secrets are write-only: once saved they show as masked and cannot be read back.
4. Save, then use Test Domains to add a domain whose users will never receive real mail.
5. Sign up a test user on that domain and read the code under Test OTP Lookup.

2.2 Users — how do I manage customer and employee accounts?

What it is. Every person with an account, split into the four tabs Customers, Employees, Invitations and Profile Attributes.

Where. Rail → Users.

Finding someone

Administrator → Users → Customers Live console

1234

1. 1Section rail — the group you are in stays expanded and highlighted.
2. 2Tab strip: customers and employees are deliberately separate lists.
3. 3Search by email or customer ID; the filter persists across pages.
4. 4Manage opens the person detail page. Available tabs depend on account type and enabled tenant features.

1. Pick the right tab — customers and employees are separate lists.
2. Search by email or ID in the search box above the table.
3. Press Manage on the row to open the person's detail page.

The person detail page

Administrator → Users → person detail Live console

1234

1. 1The available tabs cover profile, sign-in or service-user security, groups, roles, applications, optional employee vaults and tenant membership, supported devices, entitlements, sessions and activity.
2. 2Profile attributes, including any custom fields you define.
3. 3Account state: user type, credential status, profile completeness.
4. 4Restrict this account — lock, deactivate and delete, separated from everyday edits.

The tab strip under the person's name shows the sections supported for that account type and current tenant configuration:

• Profile — name, contact details and every profile attribute. The right column shows Account state and Restrict this account.
• Credentials — the sign-in methods they hold; add, change or delete one.
• Groups / Roles / Applications — what they belong to and may reach.
• Tenants — the customer organisations they are a member of.
• Devices — machines they have signed in from.
• Entitlements — fine-grained grants beyond roles.
• Session — live sessions, with the option to end them.
• Activity — the audit trail for this person.

Profile Attributes

Attributes are the fields on everyone's profile. Each one carries a visibility, shown as a coloured chip in the list — click a chip to edit the attribute.

2.3 Groups — how do I grant access to many people at once?

What it is. Bundles of people. Grant a role to a group and everyone in it inherits it, which is nearly always better than granting roles one person at a time.

How. Rail → Groups → Add New Group. Open a group to manage Members, Access and Audit. Groups can be marked SCIM-enabled so an external directory keeps membership in step.

Administrator → Groups Live console

12

1. 1Each group can be SCIM-enabled so an external directory owns membership.
2. 2Open a group for Members, Access and Audit.

2.4 Accounts & tenants — how does multi-tenant identity work?

What it is. Separate customer organisations inside one WebFrolic site. Each tenant has its own members, roles, domains and sign-in configuration.

Where. Rail → Accounts. Manage attributes beside the list edits the fields every tenant carries.

Administrator → Accounts (tenants) Live console

12

1. 1Home page and SCIM state per tenant.
2. 2Manage opens the tenant with its own Members, Roles, Domains and Firewall tabs.

Inside a tenant you will find Home, Members, Groups, Roles, Access, Verified domains, SCIM firewall, Network firewall, SAML and OAuth2 configuration, Discovery and Audit.

B2B patterns: what each customer organisation gets

2.5 Devices

What it is. Device records and the device inventory used by the identity console. The JSP views separate managed devices, personal devices and device SKUs. How. Rail → Devices. Use the relevant list to create, inspect or edit supported records; open a device to review its owner and available assignment details. Actions depend on the selected device type.

How. Rail → Devices. Open one to see its owner, first and last use, and to retire it.

2.6 Authorization — how do roles, scopes and resources (RBAC) fit together?

What it is. What may be done, and by whom. Three pages that build on each other.

Role tabs

Administrator → Authorization → Roles Live console

12

1. 1Home, Permissions, Assignments, Access, Network Firewall, Audit.
2. 2Assurance level lives here — raise it to force step-up for this role only.

• Home — name, description, assurance level, and the enable / disable / delete actions.
• Permissions — the scope-and-resource pairs the role grants.
• Assignments — who holds the role.
• Access — what the role reaches in practice.
• Network Firewall — address rules that apply whenever this role is used.
• Audit — every change made to the role.

2.7 Authenticators — which multi-factor and passwordless methods are supported?

What it is. The ways a person can prove who they are: password, one-time code by email or SMS, TOTP app, passkey or security key, mobile push, mTLS, OAuth2 and security questions.

How. Rail → Authenticators, open one to edit. Each carries whether it may be used for sign-in, whether it may be used for recovery, and how many a person may hold.

2.8 Applications — how do I connect a SAML or OAuth2 application?

What it is. Every system that trusts WebFrolic for sign-in.

Opening an application gives you General, Redirect URLs, Scopes, Claims, Assignment settings, SCIM, Assignments, Groups, Firewall, Access and Audit.

Administrator → Applications Live console

12

1. 1Protocol and status per application.
2. 2Open an application for Redirect URLs, Scopes, Claims, SCIM and Assignments.

client_id     = APPMURZ1MPSB1EER5
issuer        = https://auth.example.com/auth
authorize_url = {issuer}/oauth2/authorize
token_url     = {issuer}/oauth2/token
scopes        = openid profile email

2.8.1 Connections — where are external connections managed?

What it is. The separate Connections area in the administrator rail for managing configured external connections.

Where. Administrator console → Connections. The JSP views expose a connection list and create/edit flows, with detail areas for credentials, access, firewall rules, usage and audit.

2.9 Automation

What it is. Rules and workflows that act without anyone pressing a button: assign a role on signup, start an approval, react to an event.

How. Rail → Automation. Build a workflow from steps, then attach it to a rule — a signup rule, a group rule or an event.

2.10 Vault — which stored values and signing keys are managed here?

Where. Administrator console → Vault. The rail contains four entries:

• Secrets — sensitive values stored for use by configured services. Treat saved secrets as credentials and follow the UI's masked/write-only behavior.
• Variables — non-secret values managed centrally rather than copied across configurations.
• OAuth2 Secret — OAuth2-related secret configuration.
• JWK Keys — JSON Web Key configuration for token-signing and verification use.

API Keys are a separate administrator-rail area, not a Vault submenu. See API Keys and permission-level support.

2.10.1 API Keys — how are API-key permissions and expiry configured?

Where. Administrator console → API Keys. This is a separate administrator-rail area from Vault.

Before creating a key, review the relevant resource permissions and enable API Key Support? only for actions intended to be callable with a key. A key's selected permission list should be the minimum set needed by its integration. Use an expiry, review last-used information and revoke keys that are no longer required.

2.11 Security — how do I restrict access by network and repeated failures?

Administrator → Security → Firewall Live console

12

1. 1Allow and deny ranges in CIDR notation.
2. 2Custom rate limits and friction locks are managed here; JWK Keys are under Vault.

2.12 Logs

What it is. Operational log views for errors, webhook deliveries and transactions. Where. Administrator console → Logs, then choose the relevant view: Errors, Webhook or Transaction. Use the filters and record details available on that page to investigate the event type you selected.

How. Rail → Logs, then filter by date, actor or outcome. Individual records link back to the person or application involved.

3. Help desk console — how do support agents manage users without admin rights?

What it is. A ticket queue for people who support users but should not configure identity. Two desks — IT Service Desk and Customer Support — each with Board, My Tickets and Categories.

Where. Dashboard ▾ → Help desk. Both desks appear in the rail; the one you are working in is open.

Help desk → IT Service Desk → Board Live console

123

1. 1IT Service Desk and Customer Support are separate queues.
2. 2Filter by priority, assignee and status.
3. 3SLA countdown per ticket; overdue items are flagged.

1. Open Board and filter by priority, assignee or status.
2. Open a ticket to read its subject, description, attachments and comment history.
3. Add a comment, attach a file, or reassign it.
4. Close the ticket when the customer confirms, or escalate by changing category.

4. Employee console

What it is. The self-service view for staff: discover resources, request access, track approval tasks, see applications and groups, find colleagues and raise support tickets. Where. Dashboard ▾ → Employee. The JSP views include the resource catalogue and access requests, approval tasks, People, Applications, My Groups and IT Service Desk. Available items depend on the account and enabled features.

Where. Dashboard ▾ → Employee.

• Self service — request access and track approvals.
• People — the staff directory.
• Applications — what the person can open.
• My Groups — membership, and groups they own.
• IT Service Desk — raise and follow tickets.

5. My account — what can every user change themselves?

Everyone has this, whatever their role. Dashboard ▾ → My account.

My account → Personal API keys Live console

12

1. 1Profile, credentials, communication methods, sessions, keys and support.
2. 2Personal API keys are managed from the account area; review their selected permissions and expiry before sharing them with an integration.

6. Appearance & theming

The console follows your system light or dark setting, and the switch in the top bar overrides it. Three states, and your choice is remembered on that browser.

7. Troubleshooting

Still stuck?

Raise a ticket from My account → Customer support and include the time, the person's ID and what you expected to happen.

Related reading