First login

You've finished Installation, configured at least one sign-in provider, and pointed a browser at your Orbtrace URL. Here's what happens next.

What the sign-in screen looks like

A centred panel with the Orbtrace logo, a one-line tagline, and one button per identity provider you configured: Continue with Google, Continue with Microsoft, Continue with GitHub, or your custom SSO button (whatever label you set with ORBTRACE_OIDC_DISPLAY_NAME).

In a production setup everyone signs in through an identity provider — that's where MFA, lockout, and offboarding live. On a fresh install with no SSO configured yet, you'll instead see a username/password form for the auto-provisioned break-glass admin: username admin@orbtrace.local, password generated per-install — read it from the Helm Secret or the startup log (Sign-in & SSO has both commands). Your first login forces a password change before Orbtrace issues a session.

Below the buttons is a small footer showing the build commit and server time. A glance to confirm the server time agrees with your wall clock catches a class of "why are my timestamps wrong" support tickets later.

The first sign-in

1. 1

   Sign in — provider button, or the break-glass form

   With SSO configured: click your provider's button. You'll be redirected to that provider's familiar sign-in page — Google, Microsoft, GitHub, or your corporate SSO — including any MFA prompts your IdP requires. You'll come back to Orbtrace automatically.

   Fresh install (no SSO yet): enter the break-glass credential (admin@orbtrace.local + the generated password). Orbtrace immediately asks you to set a new password (minimum 8 characters) — the generated one is single-purpose and won't be accepted again. You continue straight in after choosing it.

2. 2

   Land on the home screen

   You arrive at the Home dashboard. At this point there is no telemetry flowing in yet, so most panels show "No data" placeholders. That's expected for a brand-new install.

3. 3

   Verify you're the administrator

   Open the user menu in the top-right. If you see an Admin entry, you have administrator rights. If not, your account is USER — go to Sign-in & SSO → Who becomes the first administrator to pin your email as the bootstrap admin, then sign out and back in.

4. 4

   Promote one teammate to administrator

   Open Admin → Users. Wait for at least one teammate to sign in once so their account exists, then change their role from USER to ADMIN.

   Having two administrators means you can never lock yourself out by losing access to one set of credentials.

5. 5

   Verify these four things before opening the doors

   Open Admin → Health and check each section:

   • Database — PostgreSQL: green dot, latency under 5 ms
   • Telemetry — Apache Doris: green dot, both FE and BE reachable
   • Cache — Valkey: green dot
   • Identity provider: the IdP you configured shows as reachable (Orbtrace pinged its discovery endpoint at startup)

   If any dot is red, do not invite users yet — go to Troubleshooting first.

Roles, in one paragraph

Orbtrace has two roles:

Role assignment lives in Admin → Users. There is no per-screen or per-service permission — Orbtrace is single-tenant, and the role you have applies to the whole instance. To isolate teams from each other, give each team a separate Orbtrace deployment (Helm namespace or VM).

The full breakdown of how roles interact with sign-in providers lives in Sign-in & SSO.

Where to go next

• You're ready to point your apps at Orbtrace → Instrument your apps.
• You want to lock the install down before showing it around → Configuration.
• You want a tour of every screen → The UI tour.