PKI/CAC Login

The brewlytics login page offers more than one way to prove who you are. Alongside the usual email-and-password form, it can present a PKI tab and a CAC tab for client-certificate sign-in, and a Social tab for signing in through an external identity provider — GitLab, GitHub, Google, LinkedIn, Twitter, or Facebook.

Login Methods

Which tabs actually appear is a per-deployment setting, not something every instance offers — an administrator sets the tab list and order for the deployment (through the system configuration, not a dedicated login-settings screen). A typical configuration shows Credentials, PKI, and Social; the CAC tab behaves identically to PKI — the same certificate-based flow, just labeled for organizations that specifically use Common Access Cards. The first tab in that configured list is the one shown when the login page loads. Switching tabs clears any in-progress input and error message from whichever tab you were just on, so a failed password attempt doesn’t linger behind you when you switch over to try PKI instead.

Once you’re signed in, brewlytics does remember how you authenticated — but that memory is used later, not on this page. If your session times out while you’re using the app, the re-authentication prompt that appears is locked to the same method you originally signed in with for Credentials, PKI, or CAC (a password field for a Credentials login, a one-click re-verify for PKI/CAC), rather than making you pick a tab again. Social sign-in doesn’t offer this in-place recovery — a revoked social session signs you out and returns you to the login page to sign in again.

Using PKI/CAC

The PKI and CAC tabs work identically — each presents a single button rather than a form. Clicking it sends a request with your browser’s client certificate attached; the browser handles the certificate-selection prompt itself before the request goes out.

If your certificate doesn’t carry an email address, brewlytics can’t match it to a profile on its own. In that case the tab grows an email field: enter the address you want attached to your profile and click the button again to complete sign-in with that email tied to your certificate going forward.

Social Login Providers

The Social tab lists whichever external identity providers the deployment has configured, from GitLab, GitHub, Google, LinkedIn, Twitter, and Facebook. Clicking a provider’s button redirects you to that provider to authenticate, then back to brewlytics with an authorization code. A dedicated callback page exchanges that code for a brewlytics session — you’ll briefly see a “Completing authentication…” screen before landing in the app.

Troubleshooting

A few error conditions are common enough across the certificate and social flows to call out by name:

• Account requires activation by administrator. Shown when your account exists but hasn’t been activated yet, on PKI/CAC and social login alike. An administrator needs to activate the account before you can sign in.
• Unable to obtain e-mail address from provider. A social-login-only error: the provider didn’t return an email address for your account there. Check that account’s privacy/email-visibility settings with the provider and try again.
• Client Certificate missing email address. A PKI/CAC-only error covered above under Using PKI/CAC — supply an email in the field that appears and resubmit.
• Account is missing required registration information. A PKI/CAC error meaning your account is missing onboarding details the deployment requires; the message names which fields are missing when that information is available.
• Problem with PKI Credentials. Shown when no certificate was selected, or the browser rejected the prompt. If you hit Cancel on the browser’s certificate prompt, you may need to restart your browser to clear its certificate cache before trying again.