Secure — overview
The security of a Liberty Next install: who can sign in (local users, OpenID Connect, sign-in throttle), what they can open (roles, allow and deny permissions), which rows they see (data scope), how secrets are stored (ENC: values), and the licence.
Sign-in — local and OIDC
Local users, optional OIDC sign-in against any compliant provider (Keycloak, Azure AD, Auth0, Okta…). What the user sees at sign-in.
Roles and permissions
Liberty Next roles: what a role grants, edited on the application's own menu tree (inherit / allow / deny per folder or entry, sidebar preview), the rules beyond the menus, and the data scope that restricts which rows a role sees — by company, by any dictionary item, from a user attribute.
Users
The Liberty Next → Administer → Access → Users tab — add local users, manage OIDC users that landed at first sign-in, assign roles, toggle is_active and is_superuser, reset passwords.
Encrypted secrets
How Liberty Next stores pool passwords, API credentials, the licence key, the AI key, the OIDC client secret and the SMTP password: encrypted as ENC: values on every save from Settings, with the install's master key.
License key
The Liberty Next licence key: what it unlocks (Nomasx-1, Nomajde), where to paste it (Liberty Next → Administer → App → License), how to check it (liberty-license, /api/license), what happens without it, and how to replace it before it expires.