Getting started — Sign-in¶
One Pub Invest account signs you in to everything: the DevOps portal, GitLab, Headlamp,
kubectl and the VPN. Sign-in is handled by Keycloak.
First sign-in¶
- Sign in with the username and temporary password you were given, and set a new password.
- Enrol an authenticator app (TOTP) when asked — everyone does this. Any TOTP app works (1Password, Microsoft Authenticator, Google Authenticator, …).
- Optional, recommended: add a passkey or security key. A passkey signs you in with one tap and is accepted by every app, including the admin and remote-access ones.
How strongly you need to sign in¶
| Level | You do | Needed for |
|---|---|---|
| 2 (default) | Password + TOTP code, or a passkey | Almost everything |
| 3 | A passkey, or a security key with PIN / biometric | Admin and remote-access tools; lasts 1 hour |
Sessions¶
- You stay signed in for up to 12 hours (8 hours if idle).
- If you lose access to an app after leaving a team, that's expected — it takes effect within about 5 minutes.
Problems¶
- "403: no access to this app" — you're signed in but not in a group that grants access. Ask your team owner to add you in the DevOps portal.
- Lost your phone / authenticator — TODO: reset process and who to contact.