Dashboard Operations

Security Actions

This section provides emergency security actions that affect the entire authorization server. These operations are irreversible and should only be used in response to confirmed or suspected security incidents. Normal day-to-day administration does not require the use of these controls.

Global Token Revocation:

Immediately revokes all active tokens across every client and every user in the system, including access tokens and refresh tokens. All authenticated sessions backed by OpenIddict tokens will be invalidated and users will be required to complete a new authorization flow to obtain fresh credentials.

Use this action when a systemic compromise is suspected — for example following a critical vulnerability disclosure such as a CVE affecting the token format or the underlying cryptographic infrastructure, or when sensitive cryptographic material may have been exposed across the entire system. For incidents affecting only a single client application, prefer the targeted revocation available in the Security tab of the individual client configuration instead.

Implications:

All users are affected: every active session backed by an OpenIddict token will be terminated, regardless of the client or the user role. This includes administrators.
Refresh tokens are invalidated: client applications relying on refresh tokens to maintain long-lived sessions will not be able to silently renew access and will need to trigger a new authorization flow.
No selective exclusion: it is not possible to exclude specific clients or users from this operation. If a more targeted revocation is needed, use the per-client or per-user revocation controls instead.

Additional impact when Data Protection is active:

If the server is configured to use ASP.NET Core Data Protection as the token format, the global revocation will also revoke all Data Protection master keys. This ensures that tokens and authentication cookies protected with the compromised keys are immediately rejected, even if they have not yet expired.

Because the administrator's own session cookie is protected by the same keys, you will be automatically signed out as soon as the operation completes. You will need to sign in again to resume administrative operations. Ensure you have valid credentials available before proceeding.

This behavior is consistent with the recommendations issued by the ASP.NET Core security team for responding to Data Protection vulnerabilities such as CVE-2026-40372.

Application Logs

The Application Logs widget provides direct access to the IdentitySuite log files from the Dashboard, without requiring access to the server filesystem. It also allows changing the active log level at runtime.

Log Level

The dropdown controls the global minimum log level currently active on the server. Changing it takes effect immediately without restarting the application, and the new value is persisted to the settings file so it survives future restarts. See the Logging documentation for guidance on choosing the right level and the impact of low levels in production environments.

Log Viewer

The View button opens the log viewer dialog. The viewer has two views:

File list — shows all available log files with their date and size. Each file can be opened for viewing or downloaded directly.

Log viewer — displays the content of the selected file with color-coded entries by severity level. A search box allows filtering entries by text across the message, source context, and exception. A level filter allows narrowing the view to specific severity levels. Multiple filters work together — only entries matching all active filters are shown.

Live Mode

When viewing the log file for the current day, live mode is activated automatically. New log entries written to the file are detected and appended to the viewer in real time without requiring a manual refresh.

Auto-scroll — when the viewer is scrolled to the bottom, new entries cause the view to scroll automatically to keep the latest entry visible.

New entries badge — when the viewer is scrolled up to read older entries, a badge appears showing how many new entries have arrived. Clicking it scrolls back to the bottom.

Live toggle — live mode can be paused and resumed at any time using the toggle button in the viewer toolbar.

💡

Live mode and active filters

Text and level filters apply to live entries as they arrive — only entries matching the active filters are shown in real time. The new entries badge counts only entries that pass the current filters.

License & Usage

Gives a quick read of the license currently active on this installation and how close it is to its limits, without needing to open the full License configuration page.

What's shown:

License type — Free, Standard, or Enterprise, plus the expiry date when the license is time-limited.

Active clients — the number of distinct OAuth clients that have made a request recently, against the plan's client limit.

Active users — the number of distinct users that have authenticated recently, against the plan's user limit.

💡

Manual refresh

Like the rest of the widgets on this tab, the card loads once when you open the Dashboard. Use its own Refresh button to pull the latest active client/user counts on demand.

System Health

Surfaces the result of the ASP.NET Core health checks registered by IdentitySuite, the same checks exposed on the application's health check endpoints, without leaving the Dashboard.

Checks included:

IdentityDbContext — verifies the configured database is reachable.

Memory — reports the current process and system memory usage, flagging Degraded above 80% and Unhealthy above 90%.

Any additional health check registered by the host application (for example a database provider's own check) appears here automatically — no Dashboard changes are required to surface it.

Each entry shows a status badge (Healthy, Degraded, or Unhealthy) together with a short description. Use the Refresh button to re-run the checks on demand.

Email Test

Verifies the configured email sender end-to-end without having to trigger a real account flow such as a password reset.

How it works:

The address field is pre-filled with the currently signed-in administrator's email as a convenience, but it can be changed to any address before sending — useful when that profile email isn't a real, deliverable inbox (for example a placeholder such as admin@example.local). The Send button sends a short test message to whatever address is entered, using the same email sender configured for the rest of the application (SMTP or SendGrid, depending on your setup). A confirmation or failure message appears once the attempt completes — a failure typically points to a misconfigured sender, invalid credentials, or a network/firewall issue reaching the mail provider.