Skip to content

Early access features #120

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
infeo wants to merge 2 commits into
base: develop
Choose a base branch
from
Open

Early access features #120

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a8fe0b4
Update user & group management docs for new Hub UI
iammajid Jan 7, 2026
5015685
Add Coming Soon section for early access features
iammajid Feb 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions docs/coming-soon/_category_.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
{
"label": "Coming Soon",
"position": 7,
"link": {
"type": "doc",
"id": "coming-soon/index"
}
}
18 changes: 18 additions & 0 deletions docs/coming-soon/index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
---
id: index
title: Coming Soon
sidebar_position: 1
---

# Coming Soon

These features are currently in **early access** and will be fully available in upcoming releases.

## Hub 1.5.0

- [User & Group Management](/hub/user-group-management) — Manage users, groups, roles, and permissions directly in Hub
- Emergency Access {/* TODO: Replace with link once docs are created */}

## Desktop 1.19.0

- Files-in-use {/* TODO: Replace with link once docs are created */}
190 changes: 153 additions & 37 deletions docs/hub/user-group-management.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,69 +6,185 @@ sidebar_position: 3

# User & Group Management

Users and groups are managed in [Keycloak](https://www.keycloak.org/), a powerful, open source identity and access management solution.
In the default configuration Cryptomator Hub provides its own Keycloak instance, but you can also integrate an existing instance.
:::info Early Access
This feature is currently in **early access** and will be fully available in an upcoming release.
:::

You can access the Keycloak management interface over the admin section of Hub.
Users and groups are managed directly in the Cryptomator Hub admin interface. As an administrator, you can create, edit, and delete users and groups, assign roles, and manage group memberships.

<Image src="/img/hub/access-keycloak-link.png" alt="Accessing Keycloak via Hub" width="1440" height="653" />
Access the user and group management from the navigation bar in the admin area.

There you can perform all users or groups related tasks, such as
[creating new users](https://www.keycloak.org/docs/latest/server_admin/index.html#proc-creating-user_server_administration_guide),
[deleting users](https://www.keycloak.org/docs/latest/server_admin/index.html#proc-deleting-user_server_administration_guide) or
[manage groups](https://www.keycloak.org/docs/latest/server_admin/index.html#proc-managing-groups_server_administration_guide).
## User Management {#user-management}

### User List {#user-list}

The user list displays all users in your Hub instance. You can search for users by name or email and see key metrics for each user:

- Number of accessible **vaults**
- Number of **group** memberships
- Number of registered **devices**

<Image src="/img/hub/user-list.png" alt="User list overview" width="1440" height="600" />

### Create User {#create-user}

To create a new user, click the "Create User" button in the user list. Fill in the following fields:

- **Profile Picture URL**: Optional URL to a profile picture
- **First Name**: The user's first name
- **Last Name**: The user's last name
- **Username**: A unique identifier for the user (cannot be changed later)
- **Email**: The user's email address
- **Roles**: Assign roles to the user (see [Roles](#roles))
- **Password**: Set an initial password for the user

<Image src="/img/hub/user-create.png" alt="Create user form" width="800" height="700" />

After creation, the user can log in with their credentials and complete the [account setup](your-account.md#account-setup).

### Edit User {#edit-user}

To edit a user, navigate to the user's detail page and click "Edit". You can modify:

- Profile Picture URL
- First Name
- Last Name
- Email
- Roles
- Password (set a new password)

:::note
Subgroups are not supported at this time.
Username cannot be changed after user creation.
:::

## Connect External IAM {#connect-external-iam}
### Delete User {#delete-user}

Alternatively to the in-house administration, you can also connect Keycloak to other identity and access management solutions (IAM) to keep your user management centralized.
You can either only synchronize existing users and groups from your IAM (using LDAP or Active Directory) or completely delegate the authentication process to your IAM via OpenID Connect or SAML.
To delete a user, you can either click the delete button in the user list or navigate to the user's detail page and click on the options button next to the "Edit" button, then select "Delete". A confirmation dialog will appear. Deleting a user will:

Setting up LDAP synchronization is described in the [Keycloak documentation](https://www.keycloak.org/docs/latest/server_admin/#_ldap).
For OpenID Connect and SAML, the Keycloak documentation provides [general information](https://www.keycloak.org/docs/latest/server_admin/#_identity_broker).
A good step-by-step guide for connecting Microsoft Entra with OpenID Connect can be found [here](https://dev.to/andremoriya/keycloak-azure-active-directory-4cg4).
- Remove the user from all groups
- Revoke access to all vaults
- Delete all registered devices

:::note
With `LDAP`, all users and groups are imported and synchronized with Keycloak, so they are available immediately after setup.
With `OpenID Connect` or `SAML`, users are unknown to Keycloak and Hub *until they log in for the first time*.
:::warning
This action cannot be undone.
:::

### User Details {#user-details}

The user detail page shows comprehensive information about a user:

- **Groups**: All groups the user is a member of
- **Accessible Vaults**: Vaults the user has access to (directly or through group membership)
- **Devices**: All registered devices of the user
- **Legacy Devices**: Devices registered with older Hub versions (see [Legacy Devices](your-account.md#legacy-devices))

<Image src="/img/hub/user-detail.png" alt="User detail view" width="1440" height="800" />

## Group Management {#group-management}

Groups allow you to organize users and grant vault access to multiple users at once.

### Group List {#group-list}

The group list displays all groups with:

- Number of **members**
- Number of accessible **vaults**

<Image src="/img/hub/group-list.png" alt="Group list overview" width="1440" height="600" />

### Create Group {#create-group}

To create a new group, click the "Create Group" button. Fill in:

- **Profile Picture URL**: Optional URL to a group picture
- **Name**: A descriptive name for the group

<Image src="/img/hub/group-create.png" alt="Create group form" width="800" height="400" />

### Edit Group {#edit-group}

To edit a group, navigate to the group's detail page and click "Edit". You can modify the group name and profile picture URL.

### Delete Group {#delete-group}

To delete a group, you can either click the delete button in the group list or navigate to the group's detail page and click on the options button next to the "Edit" button, then select "Delete". A confirmation dialog will appear. Deleting a group will:

- Remove all members from the group
- Revoke group-based vault access (users may still have direct access)

:::warning
Regardless of your choice, your Keycloak instance always contains two local users: `admin` and `syncer`. **Do not edit or delete them!** The first one is for administration tasks and the second one is used to synchronize users and groups between Keycloak and Hub.
This action cannot be undone.
:::

### Group Details {#group-details}

The group detail page shows:

- **Members**: All users who are members of this group
- **Accessible Vaults**: Vaults the group has access to

<Image src="/img/hub/group-detail.png" alt="Group detail view" width="1440" height="800" />

### Manage Group Members {#manage-group-members}

From the group detail page, you can:

- **Add Members**: Click "Add Member" to search for and add users to the group
- **Remove Members**: Click the remove button next to a member to remove them from the group

<Image src="/img/hub/group-add-member.png" alt="Add member dialog" width="600" height="500" />

:::note
Subgroups are not supported at this time.
:::

## Roles {#roles}

There are four different roles in Cryptomator Hub:
There are three roles in Cryptomator Hub:

* **user**: A user can open vaults and manage their own account.
* **admin**: An admin manages the Keycloak realm, can see the audit log, and can create vaults.
* **create-vault**: Only users with this role can create vaults. The role is inherited by the `admin` role.
| Role | Description |
|------|-------------|
| **user** | Default role. Can open vaults and manage their own account. |
| **admin** | Can manage users and groups, view audit logs, and create vaults. |
| **create-vault** | Allows users to create new vaults. Inherited by the admin role. |

The `user`, `admin`, and `create-vault` roles are assigned to users or groups via the Keycloak admin console by an existing user with the `admin` role.
Roles are assigned when creating or editing a user. The `user` role is assigned by default to all users.

### Create Vault Role {#create-vault-role}

By default, this role is only assigned to the `admin` role. This means that only users with the `admin` role can create vaults. If you want to allow other users to create vaults, you can assign the `create-vault` role to them directly or via a group.
By default, only users with the `admin` role can create vaults. To allow other users to create vaults, assign the `create-vault` role to them when creating or editing the user.

## User Avatars {#user-avatars}

If you want that all users can create vaults, assigning the `create-vault` role as transient role to the `user` role. This way, every user will have the `create-vault` role as well.
Users can have profile pictures displayed throughout Hub (e.g., in vault member lists). As an administrator, you can set the profile picture URL when creating or editing a user.

To allow all users vault creation, assign `create-vault` as a transient role to the `user` role:
The avatar can be provided as a URL to an image (e.g., `https://example.com/avatar.png`).

1. Open the Keycloak admin console.
2. Select `Realm roles`.
3. Select the `user` role.
4. Select `Assign role`.
5. Select the `create-vault` role.
6. Apply with `Assign`.
If no profile picture is set, a generated avatar based on the user's name will be displayed.

## User Avatars {#user-avatars}
## Enterprise: External Identity Management {#enterprise-external-iam}

<Image src="/img/hub/access-keycloak-link.png" alt="Accessing Keycloak via Hub" width="1440" height="653" />

:::info Enterprise Feature
Connecting external identity and access management (IAM) solutions is available as an Enterprise feature. This allows you to:

- Synchronize users and groups from LDAP or Active Directory
- Delegate authentication via OpenID Connect or SAML
- Keep your user management centralized in your existing IAM

Cryptomator Hub supports user avatars. As an administrator, you can enable this feature in the administration area by creating a user "picture" profile attribute in the "User Profile" setting in the Realm in Keycloak. See [Keycloak Documentation](https://www.keycloak.org/ui-customization/avatars#_setting_a_picture_attribute_from_the_admin_console) for more information.
You can access the Keycloak management interface from the admin section of Hub. There you can perform all user and group related tasks, such as
Copy link

@coderabbitai coderabbitai bot Feb 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Minor grammar: hyphenate the compound adjective

"user and group related tasks" should be "user- and group-related tasks" (suspended hyphen).

✏️ Proposed fix 
-There you can perform all user and group related tasks, such as
+There you can perform all user- and group-related tasks, such as
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
You can access the Keycloak management interface from the admin section of Hub. There you can perform all user and group related tasks, such as
You can access the Keycloak management interface from the admin section of Hub. There you can perform all user- and group-related tasks, such as
🧰 Tools
🪛 LanguageTool

[grammar] ~177-~177: Use a hyphen to join words.
Context: ...There you can perform all user and group related tasks, such as [creating new use...

(QB_NEW_EN_HYPHEN)

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@docs/hub/user-group-management.md` at line 177, The sentence in the Hub docs
contains a compound adjective that needs suspended hyphenation; change "user and
group related tasks" to "user- and group-related tasks" in the sentence starting
"You can access the Keycloak management interface..." so the compound adjectives
are correctly hyphenated.

[creating new users](https://www.keycloak.org/docs/latest/server_admin/index.html#proc-creating-user_server_administration_guide),
[deleting users](https://www.keycloak.org/docs/latest/server_admin/index.html#proc-deleting-user_server_administration_guide) or
[managing groups](https://www.keycloak.org/docs/latest/server_admin/index.html#proc-managing-groups_server_administration_guide).

Setting up LDAP synchronization is described in the [Keycloak documentation](https://www.keycloak.org/docs/latest/server_admin/#_ldap).
For OpenID Connect and SAML, the Keycloak documentation provides [general information](https://www.keycloak.org/docs/latest/server_admin/#_identity_broker).

Visit [cryptomator.org](https://cryptomator.org/hub/) for more information about Enterprise features.

When enabled, users can define their avatar in their Keycloak profile page. The avatar is then displayed in Cryptomator Hub, for example in the vault member list.
The avatar needs to be provided as a URL (e.g. https://path_to_image.png) or as a Base64 encoded data image (e.g. `data:image/svg+xml;base64,content`).
:::warning
Regardless of your IAM setup, your Hub instance always contains two system users: `admin` and `syncer`. **Do not edit or delete them!** These accounts are required for administration and synchronization tasks.
:::
Comment on lines +170 to +189
Copy link

@coderabbitai coderabbitai bot Feb 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

:::info Enterprise Feature is never closed — the :::warning must be outside it

Docusaurus admonitions can be nested, but require more colons for each parent level. Using the same three colons means :::warning (line 187) opens a nested directive inside the still-open :::info Enterprise Feature (line 170). The ::: at line 189 then closes only the inner warning, leaving the outer :::info unclosed and extending implicitly to the end of the file.

Beyond the parse problem, the warning text ("Regardless of your IAM setup…") applies to every user — not only enterprise users — so it should live after the enterprise info block, not inside it.

🐛 Proposed fix — close the info block before the warning 
 Visit [cryptomator.org](https://cryptomator.org/hub/) for more information about Enterprise features.

+:::
+
 :::warning
 Regardless of your IAM setup, your Hub instance always contains two system users: `admin` and `syncer`. **Do not edit or delete them!** These accounts are required for administration and synchronization tasks.
 :::
🧰 Tools
🪛 LanguageTool

[grammar] ~177-~177: Use a hyphen to join words.
Context: ...There you can perform all user and group related tasks, such as [creating new use...

(QB_NEW_EN_HYPHEN)

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@docs/hub/user-group-management.md` around lines 170 - 189, The release note's
":::info Enterprise Feature" admonition is never closed and the ":::warning" was
unintentionally nested; close the enterprise info block immediately after its
content by adding a matching closing token (:::) right after the paragraph that
ends with "Visit [cryptomator.org](https://cryptomator.org/hub/) for more
information about Enterprise features.", then move the standalone ":::warning"
admonition (the paragraph about the `admin` and `syncer` accounts) outside and
below that closed info block so it applies globally; ensure you only use
three-colon tokens consistently (:::info ... ::: and :::warning ... :::) to
properly open and close each admonition.


17 changes: 17 additions & 0 deletions src/pages/index.module.css
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,20 @@
.announcementPill {
display: inline-block;
padding: 0.4rem 1rem;
margin-bottom: 1rem;
border-radius: 2rem;
background-color: rgba(255, 255, 255, 0.15);
color: white;
font-size: 0.9rem;
text-decoration: none;
}

.announcementPill:hover {
background-color: rgba(255, 255, 255, 0.25);
color: white;
text-decoration: none;
}
Comment on lines +1 to +16
Copy link

@coderabbitai coderabbitai bot Feb 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Add a :focus-visible style for keyboard accessibility

There is no explicit focus indicator for the announcement pill. Docusaurus or the browser's default may be overridden or low-contrast against the primary hero background; adding an explicit outline ensures keyboard users always get a visible focus ring.

♿ Proposed addition 
 .announcementPill:hover {
   background-color: rgba(255, 255, 255, 0.25);
   color: white;
   text-decoration: none;
 }
+
+.announcementPill:focus-visible {
+  outline: 2px solid white;
+  outline-offset: 3px;
+}

You may also want to add a transition for the hover background change to avoid the abrupt opacity jump:

 .announcementPill {
   display: inline-block;
   padding: 0.4rem 1rem;
   margin-bottom: 1rem;
   border-radius: 2rem;
   background-color: rgba(255, 255, 255, 0.15);
   color: white;
   font-size: 0.9rem;
   text-decoration: none;
+  transition: background-color 0.2s ease;
 }
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
.announcementPill {
display: inline-block;
padding: 0.4rem 1rem;
margin-bottom: 1rem;
border-radius: 2rem;
background-color: rgba(255, 255, 255, 0.15);
color: white;
font-size: 0.9rem;
text-decoration: none;
}
.announcementPill:hover {
background-color: rgba(255, 255, 255, 0.25);
color: white;
text-decoration: none;
}
.announcementPill {
display: inline-block;
padding: 0.4rem 1rem;
margin-bottom: 1rem;
border-radius: 2rem;
background-color: rgba(255, 255, 255, 0.15);
color: white;
font-size: 0.9rem;
text-decoration: none;
transition: background-color 0.2s ease;
}
.announcementPill:hover {
background-color: rgba(255, 255, 255, 0.25);
color: white;
text-decoration: none;
}
.announcementPill:focus-visible {
outline: 2px solid white;
outline-offset: 3px;
}
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@src/pages/index.module.css` around lines 1 - 16, Add an explicit keyboard
focus style and a smooth hover transition to the .announcementPill to ensure
accessible focus indication and avoid abrupt hover changes: update the
.announcementPill selector to include a transition for background-color (and
optionally color), and add a .announcementPill:focus-visible rule that sets a
clear, high-contrast outline or box-shadow (and preserve border-radius) so
keyboard users see a visible focus ring; ensure :focus-visible only applies to
the .announcementPill element and does not rely on browser defaults.


.heroLogo {
width: 160px;
height: 160px;
Expand Down
7 changes: 6 additions & 1 deletion src/pages/index.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,12 @@ function HomepageHeader() {
return (
<header className={clsx('hero hero--primary text--center', styles.heroBanner)}>
<div className="container">
<Logo
<div>
<Link to="/coming-soon" className={styles.announcementPill}>
✨ Coming Soon →
</Link>
</div>
<Logo
className={styles.heroLogo}
role="img"
aria-label="Cryptomator Logo"
Expand Down
Binary file added static/img/hub/group-add-member.png
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added static/img/hub/group-create.png
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added static/img/hub/group-detail.png
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added static/img/hub/group-list.png
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added static/img/hub/user-create.png
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added static/img/hub/user-detail.png
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added static/img/hub/user-list.png
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.