Skip to content
Tessera Tessera Docs

First-day walkthrough

You’ve installed the controller and it’s running. This page walks through everything an administrator does on day one, in order. Each step links to the full guide.

1. Secure the admin account

Section titled “1. Secure the admin account”

On a fresh database the controller bootstraps a default administrator, admin / admin, and forces a password change on first login. Do it now — this account is the primary administrator and can’t be locked out by other admins, so treat its password like a break-glass credential.

2. Install your license

Section titled “2. Install your license”

Community needs no license — skip this step. On a paid plan, get your license from the Tessera portal and install it under Settings → License: paste the offline tlic1.… token, or connect the controller to your portal organization with an activation token (tac_…) so renewals apply automatically. Details in Licensing & activation.

3. Connect SSO (optional)

Section titled “3. Connect SSO (optional)”

If your team signs in with an identity provider, add it under Settings → Authentication. Register the redirect URI https://<controller>/oidc/callback/<identifier> with your provider. Tessera doesn’t map IdP groups to roles — sign-in provisions the user, then you grant access directly in Tessera. See OIDC single sign-on and Sign-in methods.

4. Add your first target

Section titled “4. Add your first target”

In Servers → Add server, enter the host and port, then open Credentials on the target and store the SSH login (password or a key from the key library). The secret is encrypted at rest and never shown again — from now on it’s injected per connection.

5. Grant access

Section titled “5. Grant access”

Create your users under Users (or let SSO/SCIM provision them), then grant access under Access: a user or role, a target or project, and a mode — read-only or read-write. Targets are invisible to users until granted. See Access control.

Prefer approval-based access? Enable just-in-time requests so users request time-boxed access and you approve it from Requests.

6. Have a user connect

Section titled “6. Have a user connect”

Send your team the Connect quickstart — install a client, sign in, connect. Their session shows up under Sessions (live, with force-close), and every login, connection and command lands in the audit log.

Before production

Section titled “Before production”
  • Front the controller with a reverse proxy and a real TLS certificate — TLS behind nginx.
  • Set TESSERA_PUBLIC_URL to the public name so OIDC redirects and links resolve.
  • Back up tessera.secret and PostgreSQL — Backups & upgrades.

Cookies