Dashboard Overview

A real-time monitoring hub for your IdentitySuite installation — users, clients, tokens, certificates, and security events at a glance

Time Window & Refresh

At the top of the Dashboard you will find a time window selector and a refresh button. These controls determine the time range used to compute trends and activity data displayed in the charts and feeds below.

Available Time Windows:

6h — Last 6 hours. Useful for monitoring activity shortly after a deployment or configuration change.
24h — Last 24 hours. The default window, suitable for day-to-day operational monitoring.
3d — Last 3 days. Helps identify patterns that span multiple days, such as weekend traffic drops.
7d — Last 7 days. A broader view for weekly trend analysis and capacity planning.
💡

Manual Refresh:

The Dashboard does not refresh automatically. Use the Refresh button to reload all data on demand. Changing the time window automatically triggers a reload of the trend charts, while summary cards and feeds are refreshed only when you press the button explicitly.

Summary Cards

The four summary cards at the top of the Dashboard provide an instant snapshot of the current state of your installation. Each card focuses on a specific area of the system.

Users & Roles

Displays the total number of registered users and the number of roles defined in the system. When relevant, additional indicators appear below the user count:

Locked Out — Number of accounts currently under a lockout. Shown in amber as a warning signal.
Unconfirmed — Number of accounts whose email address has not yet been verified. Shown in gray.

Registered Clients

Shows the total number of OpenID Connect / OAuth 2.0 client applications registered in IdentitySuite. This count includes all client types: web applications, APIs, mobile apps, and machine-to-machine clients.

Tokens

Provides a snapshot of token activity across the installation:

Issued Tokens (Last 24h) — The number of access tokens issued in the last 24 hours, regardless of the selected time window. Gives a consistent baseline for daily activity.
Active Refresh Tokens — The number of refresh tokens currently valid and stored in the system. A significantly high number may indicate that token cleanup or rotation policies should be reviewed.

Certificate Health

Monitors the validity of the signing and encryption certificates used by IdentitySuite to issue and validate tokens. For each certificate, the card shows the number of days remaining before expiry. The card border and icon color change to reflect the current health status:

Green — All certificates are valid and not approaching expiry. No action required.
Amber — At least one certificate is expiring soon. Plan a certificate renewal to avoid authentication disruptions.
Red — At least one certificate has already expired. Token issuance and validation may be affected. Immediate action is required.

Security Overview

When the system detects accounts that require attention, an amber panel appears below the summary cards. This section is hidden when there are no actionable items, keeping the Dashboard clean during normal operations.

Locked Out Accounts:

Lists all accounts currently locked out due to repeated failed login attempts. For each account, the panel shows the username and the exact date and time when the lockout will automatically expire. An Unlock button is available next to each entry, allowing an administrator to immediately restore access without waiting for the lockout period to elapse.

At-Risk Accounts:

Lists accounts that have accumulated a significant number of failed login attempts in the last 24 hours but have not yet been locked out. For each account, the panel shows the username, the failure count, and the timestamp of the most recent failure. These accounts are potential targets of brute-force or credential-stuffing attacks and should be monitored closely.

Activity Charts

Two spline area charts visualize the trend of authentication and token activity over the selected time window. Each point on the horizontal axis represents an hourly bucket, making it easy to spot peaks, anomalies, or drops in activity.

Login Activity:

Tracks authentication attempts over time with three overlapping series:

Successful — Login attempts that completed successfully, including password, external provider, passkey, and two-factor logins.
Failed — Login attempts that were rejected due to invalid credentials or other errors.
Locked Out — Attempts blocked because the target account was locked out at the time of the request.

The totals for each series over the selected window are displayed in the card header for quick reference. A sustained rise in the failed or locked-out series may indicate an ongoing attack and warrants investigation.

Token Activity:

Tracks token lifecycle events over time with two series:

Issued — Access tokens and refresh tokens issued by the server. The trend naturally follows the shape of the successful login curve.
Revoked — Tokens explicitly invalidated before their natural expiry, typically triggered by a logout or an administrative action.

An unusually high revocation rate compared to issuance may indicate a session management issue or a security response in progress.

Activity Feeds

Two sortable, filterable grids provide a detailed record of recent system activity. Both feeds load the most recent 50 entries and support column-level filtering and sorting to help you quickly locate specific events.

Security Events:

A chronological log of authentication-related events across all users and clients. Each row shows the timestamp, event type, username, client identifier, and whether the operation succeeded. Event types are color-coded for fast visual scanning:

Success Successful logins, two-factor verifications, passkey logins, external provider logins, and recovery code usage.
Failed Failed login attempts via any authentication method.
Locked Out Authentication blocked because the account was locked.
Revoked A token was explicitly revoked.

Design Note — Token Issued events

Token Issued events are intentionally excluded from this feed. Because a token is issued on every successful authentication, including these entries would add a large volume of low-value rows that would obscure more meaningful security signals. Token issuance volume is already visible in the Token Activity chart above.

Admin Actions:

A chronological log of administrative operations performed through the IdentitySuite management interface. Each row shows the timestamp, action type, the administrator who performed the action, the target entity, and the entity type.

Expanding a row reveals the specific details of the change — for example, which claims were added, which roles were assigned, what field values were updated, or which client properties were modified. This makes the Admin Actions feed the primary audit trail for all configuration and user management changes made through the UI.

💡

Emergency security actions, application logs, license & usage, system health, and email delivery testing have moved to the Operations tab. Rate limiting metrics have their own Rate Limiting tab. See the corresponding entries under Dashboard in the menu.