Secure configuration guidance
OpenLM Platform Secure Configuration Guide
This guide tells customer administrators how to securely access, configure, operate and decommission the top-level administrative accounts of OpenLM Platform in the OpenLM US Cloud (cloud-us.openlm.com). It is provided under FedRAMP rule SCG-CSO-RSC (Recommended Secure Configuration). Follow the sections in order when you set up your account, and use the last section as a checklist for the settings that only Account Administrators control.
Purpose and scope
- Audience: the customer's Account Administrators and their security team.
- In scope: OpenLM Platform hosted by OpenLM (SaaS), including add-on products such as OpenLM Analytics, LicOps for HPC and Dongle Monitoring.
- Out of scope: on-premise deployments and the self-hosted Version 26 components.
Account roles
In OpenLM Platform, the top-level administrative account is the Account Administrator. It controls who can access the whole customer account. All accounts are managed in Platform Administration → Identity.
Sign-in accounts (people who log in to the UI) are different from monitored users (people whose license usage OpenLM tracks). This guide covers sign-in accounts and machine accounts only.
| Account | FedRAMP category | What it can do |
|---|---|---|
| Account Administrator | Top-level administrative account | Add, edit, deactivate and delete users; grant roles; configure SSO providers; create and revoke component authorization files. The user who creates the cloud account receives this role automatically. |
| System Administrator | Privileged account | Full system access, including configuration and management, and the Audit event log. |
| Product Admin | Privileged account | Configure one activated product (set per user and per product in the Products and Roles tab). |
| Audit administrator | Privileged account | Read the Audit event log. |
| Product Viewer | Standard account | Read-only access to data and reports. |
| Component authorization client | Machine account | A client ID and secret that lets an OpenLM component (for example a Broker or an agent) authenticate to the platform. |
Secure access
Administrators should sign in through your organization's identity provider (SSO), with multi-factor authentication enforced there.
- First login. Each new user receives login details at the email address entered, with a temporary password that you set. Select User must change password at next login.
- Connect your identity provider. In Identity → External Providers, select Add Provider and choose Okta, ADFS, Azure or OIDC. Enter the Client ID, Client Secret, Authority and Display Name from your provider.
- Use Authorization Code Flow. Set Client Acting to Authorization Code Flow. Use Implicit Flow only if your provider supports nothing else.
- Enforce MFA at your identity provider. Require phishing-resistant MFA (FIDO2 or passkeys) at your provider for every account that holds an administrator role.
- Sign in through the SSO login URL. Use the Login URL generated for your provider, with your account ID.
- Keep one break-glass administrator. Keep one Account Administrator with a strong, unique password, stored offline, for use only if your identity provider is unavailable.
Secure configuration
Give each person the lowest role that lets them do their job, and keep administrators few.
- Limit Account Administrators. Keep at least two (to avoid lock-out) and no more than needed. Turn on the Account Administrator toggle only for people who manage users.
- Grant product roles per product. In Products and Roles, give Viewer by default. Give Admin only on the products a person configures.
- Create users inactive when onboarding ahead of time. The Status toggle lets you create a user without granting access yet.
- Protect component secrets. In Identity → Authorization, create one authorization client per component, with a description that names it. Store the client secret in a secrets vault, never in email or tickets.
- Know your data retention. Data is kept for the length of the subscription. A suspended account keeps data for 30 days; a deleted account's data is removed after 60 days.
Secure operation
Review administrator activity and access on a fixed schedule.
| Task | How | Recommended frequency |
|---|---|---|
| Review administrator activity | Platform Administration → Audit: filter on logins, failed logins and configuration changes; export to CSV to keep a record | Monthly |
| Keep audit records | In OpenLM Cloud, OpenLM manages event retention; export events you must keep longer | Monthly |
| Review who holds admin roles | Identity → Users: check Account Administrator toggles and product Admin roles | Quarterly |
| Rotate component secrets | Identity → Authorization → Reset Secret, then update the component | Yearly, and at once if a secret may be exposed |
| Report a security issue | Email security@openlm.com | As soon as found |
Decommissioning
Remove access the same day a person leaves or a component is retired.
- Administrator leaves. Disable the person in your identity provider first, then deactivate or delete the user in Identity → Users. Make sure at least one other Account Administrator remains.
- Component retired. Delete its authorization entry in Identity → Authorization. Components using this entry lose access to the system.
- Identity provider replaced. Add the new provider, test sign-in, then delete the old provider in External Providers.
- Subscription ends. Data is retained 30 days after suspension and removed 60 days after account deletion. Export the reports and audit events you need before then.
Settings reserved to top-level administrators
These settings can only be changed by an Account Administrator. Each one affects access to the whole account.
| Setting | Where | Security implication | Recommended value |
|---|---|---|---|
| Account Administrator toggle | Identity → Users → General | Grants control over all users and roles | On for 2 to 3 named people only |
| User status | Identity → Users → General | An active user can sign in | Inactive until access is needed; deactivate on departure |
| Temporary password and forced change | Identity → Users → General | A shared temporary password stays valid until changed | Always require a change at next login |
| Product roles (Admin / Viewer) | Identity → Users → Products and Roles | Admin can change product configuration | Viewer by default |
| External identity providers | Identity → External Providers | Decides who can sign in and how MFA is enforced | Your corporate provider, with phishing-resistant MFA |
| Client Acting | Identity → External Providers | Implicit Flow passes tokens through the browser | Authorization Code Flow |
| Authorization clients and secrets | Identity → Authorization | A leaked secret lets a component connect as yours | One client per component; rotate yearly; delete when retired |
Version history
| Version | Date | Change |
|---|---|---|
| 0.1 | 22 Oct 2026 | First draft for review |
Sources: FedRAMP Secure Configuration Guide rules; OpenLM documentation (Identity, Audit).