User Manual

Introduction

This guide explains how a User will register and use the Excalibur system.

As a User, you will use the Excalibur system to securely log in and access company resources, such as PC clients, VPNs, and web applications. You will use the Excalibur mobile app as your personal security token to access the Dashboard and manage your sessions.

The Dashboard is your central hub, where you can find your profile and access your assigned PAM resources. From here, you can start new sessions, review recordings of past sessions, and search for text within those recordings.

Info

The features available to you in the Dashboard depend on how the Excalibur system is configured at your organization. This guide focuses on the standard features available to the User role.

Excalibur Mobile Application

Download Excalibur v4 Mobile Application

Before you can use Excalibur, you need to install the Excalibur v4 mobile application. You can find links to the App Stores in your email invitation, on the registration page, or at https://getexcalibur.com.

• Android: Google Play Store (Requires Android 7.0 - Nougat or higher)
• iOS: App Store (Requires iOS 15.6 or higher)
• Huawei: AppGallery

Info

Ensure your device meets the minimum system requirements for the best performance.

Main screen

The app's main screen provides a simple interface for scanning QR codes to log in. From here, you can also access your notifications and settings to manage your accounts.

Figure 1. Excalibur mobile app main screen

Notifications

You will receive notifications when there are peer verification requests from other users. To view your notifications, tap the bell icon in the main screen.

Figure 2. Notifications

Notifications support infinite scrolling, loading 10 items at a time, and a pull-to-refresh function to ensure you always have the latest updates.

Figure 3. Notification details

If you device is disconnected from deployments, a warning appears to let you know some notifications may not be available.

Figure 4. Disconnected deployments warning

You can sort your notifications by date, filter them by a specific deployment or from all deployments:

Figure 5. Sort notifications by date, filter by deployment

Each notification displays the requester's name, the requested action (e.g., "Authentication to Dashboard"), tenant name, deployment name, and the time remaining until the verification expires.

Figure 6. Peer verification request details

Tapping on each request opens its details page:

• Requester name
• Current status (e.g., "Waiting for approval")
• Time remaining until expiration
• Requested action
• Dates (Created at, Expires at)
• Server (name, tenant, URL, status)
• Action buttons: Approve or Deny

Figure 7. Verification details and actions

To approve, select your account (approver name) and tap Approve.

Figure 8. Approve peer verification

To deny, select your account (denier name), optionally provide a reason for denial, and tap Deny.

Figure 9. Deny peer verification and optional reason for denial

Info

In Nofications, you can Approve or Deny other user requests.

In Settings, you can Cancel your own request.

To view your notification history, tap "View History".

Figure 10. Notification history

The history view shows intuitive icons helping you to track past verifications easily.

Figure 11. History View Icons

Settings

To access the settings menu, tap the gear icon in the bottom-right corner. This menu allows you to manage your accounts and app preferences:

• Companies
• Peer verification
• General settings
• Other settings

Figure 12. Excalibur mobile app settings

Companies

In the settings menu, tap on Excalibur to expand the list of the companies you are registered with.

Figure 13. Excalibur mobile app companies

Select an environment name to view its details, including the server address, your registered accounts, and the tenants you can access. To remove an account, tap the Delete button.

Figure 14. Excalibur mobile app company details

Info

• Your registered accounts are sorted by tenant.
• You can tap on a username to copy it to your clipboard for quick sharing.
• If you delete an account while offline, the action is saved and will be completed automatically once your device reconnects to the internet. This ensures that your changes are not lost.

Peer Verification

This section show your own peer verification requests.

Figure 15. Peer verification

Tapping on Pending Verification to all your pending requests.

Figure 16. Pending peer verification requests

You can sort requests by date, filter them by deployments, view history with intuitive icons, view verifications details. Refer to the Notifications section for similar information.

Figure 17. Verfications history and Notification history

Unlike the Notifications section, where you can "approve" or "deny" incoming requests, this view allows you to Cancel your own pending request.

Figure 18. Verification request details and Cancel button

General Settings

In this section, you can customize the app's behavior by enabling or disabling Vibration for feedback and choosing whether to share Usage and diagnostics data.

Figure 19. General settings

Other Settings

You can change Language settings and view Application Information.

Figure 20. Other settings

• Language: Change the app's display language.

Figure 21. Change app language: English or Slovak

• Application Information: View details about the app, including its Version, Contact Information, and Legal Information.

Figure 22. Application information

Registration

Info

Registration is a one-time process. If you have already registered, you can skip this section and proceed to the Login section.

The Registration process creates a secure link between the Excalibur app on your phone and your company's Excalibur system. To begin, a system administrator will send you an invitation email.

Before you start, you will need:

1. The registration link sent by your system administrator in the invitation email.
2. Your company account password, or an OTP code from your administrator if you are using a local identity store.
3. The Excalibur v4 mobile app installed on your device (see Section Download Excalibur v4 Mobile Application for details).

Steps:

1. Open the invitation email from your system administrator. It contains a unique, time-limited registration link. Click the link or copy it into your web browser to get started.

   

   Figure 23. Email invitation

2. On the registration page, either enter your company account password or if you are a user of a local identity store, enter the OTP code provided by your administrator.

   

   

   Figure 24. Registration page - enter your OTP code

   Info

   The Excalibur app is available on Google Play Store, Apple App Store, and Huawei AppGallery. Click the appropriate icon to download.

3. After your password or OTP code is verified, a unique QR code will appear on the screen.

   

4. Open the Excalibur v4 app on your phone. If it's your first time using it, the app will ask for permission to use your camera. Allow access so you can scan the QR code.

   

5. Check that your registration details in the app are correct, then confirm.

   

6. Tap Register and allow the app to access your location. This is used as an additional security measure.

   

7. To finish, create a PIN or set up biometrics (like a fingerprint or Face ID), depending on your phone's features.

   

   

   

8. You are now registered!

   

Login

The Excalibur app is your security key for passwordless login. Follow these steps to log in to the Dashboard using the Excalibur app:

1. Go to the Excalibur Dashboard login page (provided by your administrator), where you will see a QR code.
2. Open the Excalibur app on your phone and scan the QR code.
3. If you have multiple accounts, select the one you want to use.
4. Confirm the login on your phone using your PIN or biometrics.
5. You will be logged in to the Dashboard automatically.

Excalibur supports several login methods, but you must use the online QR code method described above to access the Dashboard.

Figure 25. Dashboard login screen

Figure 26. A successful login confirmation.

Dashboard Overview

The Dashboard is the primary web interface for all users of the Excalibur system. It is used for managing your profile, accessing PAM resources, and reviewing your activity.

Info

In the Dashboard, every list allows you to filter, sort, and search for items.

Overview

Figure 27. Dashboard views correspond to the user roles in the Excalibur system.

Tenant Selector

If you have access to multiple tenants, you can switch between them using the tenant selector in the top-right corner.

Figure 28. Select a tenant

User Profile

Click the user profile icon in the top-right corner to open a dropdown menu with the following options: User Details, Preferences, Passkeys, Logs, Logout.

Figure 29. User profile dropdown menu

User Details

Select your username from the User Profile menu to open your user page. From here, you can access different tabs: General details, Audit Logs, Accessible Targets, Sessions, Actions, Permissions.

Figure 30. User details page with different tabs

General details

You can view the general information of the user: Name, Surname, E-mail, Created, Last Logged, User Group Memberships

Figure 31. User general details

Audit Logs

You can view the logs of your actions in the system.

Figure 32. User audit logs

Accessible Targets

You can have an overview of PAM targets and target groups that this user can access.

Figure 33. User accessible PAM targets

Sessions

You can have an overview of PAM sessions associated with this user.

Figure 34. User PAM sessions

Actions

You can have an overview of this user's actions within the application such as authentication, authorization, or registration events. Detailed information is available by selecting a specific action. It is identical to the Actions page described in Section Management - Actions.

Figure 35. User actions

Permissions

You can have an overview of permissions assigned to this user.

Figure 36. User permissions

You can search for specific permissions using the search bar.

Figure 37. Search user permissions

You can also filter permissions by types such as READ, CREATE, UPDATE, DELETE, AUDIT, OTHER.

Figure 38. Filter user permissions by UPDATE type

Preferences

Select Preferences from the User Profile menu to open the Preferences page.

Figure 39. Preferences page

On this page, you can change the display language and switch between your assigned roles.

Language Selection

Figure 40. Preferences - Language selection

Role Switcher

Figure 41. Preferences - Role switcher

You can switch between the different roles you have access to. Your available roles are displayed in the Role box.

Passkeys

Select Passkeys from the User Profile menu to open the Passkeys page.

Passkeys are a simple and secure way to log in without a password. Instead of a password, you use your device (with a fingerprint, face scan, or PIN) to prove it's you. Each Passkey is unique to your account and is stored securely on your device, in a third-party app, or on a hardware key like a YubiKey.

Figure 42. Select Passkeys

Create a Passkey

To create a new Passkey, click the plus button.

Figure 43. Click the plus button to create a Passkey

Give your Passkey a descriptive name and a brief description of its purpose, then click Confirm.

Figure 44. Create a Passkey

After creating a Passkey, you can see it in your Passkeys list, which shows its name, description, usage count, and creation date.

Figure 45. Passkeys list

Once a Passkey has been added, you can log out and use it to log back in.

Login with Passkey

From the login screen, instead of scanning the QR code, click LOGIN WITH PASSKEY and follow the prompts on your device to log in to the Dashboard.

Figure 46. Click LOGIN WITH PASSKEY on the Login screen

Figure 47. Login with Passkey

After completing these steps, you will be successfully logged in to the Dashboard.

Passkey Audit Logs

Info

Audit logs are available only for users with the Auditor or Administrator role.

Users with the appropriate permissions can view the audit logs for their Passkeys by clicking a Passkey on the Passkeys settings page.

Figure 48. Passkey Audit logs

Passkey Registration Error Handling

The Passkey registration process includes clear error messages to help users troubleshoot common issues.

• "No Passkey has been selected for deletion"
• "Missing discoverable credential support"
• "Missing user verification support"
• "No supported public key credential parameters algorithm"
• "One Passkey already exists on this device. Please remove it first."
• "Passkey registration ceremony was aborted"
• "Invalid domain"
• "Invalid Relying Party ID"
• "Invalid User ID length."
• "Malformed public key credential parameters"
• "Passkey registration failed"

Logs

Info

• Logs older than 30 days are automatically deleted.
• Logs are stored persistently in the browser that you are using. A different computer, or a different browser on the same computer will have different logs.

The user can access Error and Warning Logs in the profile menu.

Figure 49. Access to Logs in the profile menu

The Logs icon shows the number of current logs. Clicking the Logs icon opens a list of errors and warnings.

Figure 50. Clicking the Logs display error and warning logs

Users can filter the view to show only errors or only warnings

Figure 51. Filter the view to show only errors or only warnings or all

Each log entry includes copy and delete buttons.

Figure 52. Each log entry includes copy and delete buttons

You can also clear all the log entries by a "clear" button at the bottom.

Figure 53. Clear all log entries

Logout

Select Logout from the User Profile menu to log out of the Dashboard.

Navigation Side Panel

Overview

The navigation panel on the left contains several sections. This document focuses on the User role, which has access to the following:

• Management: Actions, Authenticators, Peer Verification, PAM
• SAML: Service Providers
• Settings: About

Figure 54. Navigation side panel

Navigation Breadcrumbs

Breadcrumbs show the path to your current location within the Dashboard.

Figure 55. Navigation breadcrumbs

The navigation panel is expanded by default. To save space, you can collapse it by clicking the "menu" icon.

Figure 56.1. Navigation side panel - expanded

Figure 56.2. Navigation side panel - collapsed

Figure 56. Navigation side panel

Management

Actions

Overview

This page shows a detailed history of your activity in the system, including authentications, authorizations, and registrations.

Figure 57. Actions overview

To see more details about a specific action, click on it. A side panel will open with information organized into the General, Location, and Validation Result tabs.

General Tab

Figure 58. Action authentication - General

Location Tab

Figure 59. Action authentication - Location: Map view (names have been blurred)

Figure 60. Action authentication - Location: Satellite view (names have been blurred)

Validation Result Tab

The Validation Result tab shows all the security policies that were checked for the action. Each policy is displayed in an expandable section. When you expand a section, you will see all the rules within that policy. Rules that were met are marked with a green checkmark, while rules that were not met have a red cross.

Each policy also displays additional details like the date and time, the phone’s IP address, and its connection status.

Figure 61. Action authentication - Validation result

Authenticators

This section lists all your registered security tokens (your mobile devices) and provides general information about them.

Figure 62. Token overview

Clicking on a token opens its details page.

Figure 63. Token details

Peer Verification

This section displays all pending, resolved and your own peer verification requests.

Figure 64. Peer Verification overview

Info

You can also view details and handling peer verification requests on Excalibur v4 mobile application. Refer to the Mobile - Notifications and Mobile - Peer Verification sections for more details.

Pending Verifications

Figure 65. Pending Verifications tab

You will receive a notification in the dashboard when there is a new peer verification request.

Figure 66. New peer verification request notification

Info

You will also receive a notification on your Excalibur v4 mobile application. Refer to the Mobile - Notifications section for more details.

In Actions column, you can Approve or Deny other users' requests or Cancel your own requests.

When "Cancel" a request, a confirmation dialog appears.

Figure 67. Cancel peer verification request confirmation

When deny a request, you can optionally provide a reason for denial.

Figure 68. Deny peer verification with optional reason for denial

Once confirmed, you will see a notification in the bottom of the screen.

Figure 69. Peer verification action confirmed notification

Clicking on each row will show more details of the verification and possible actions: Approve, Deny or Cancel.

Figure 70. Verification details

Resolved Verifications

You can view all your resolved peer verification requests in this tab: Approved, Denied or Closed requests.

Figure 71. Resolved Verifications tab

Your Own Verifications

You can view all your own peer verification requests in this tab: Pending, Timed out, Approved, Denied or Closed requests. You can also perform the Cancel action on your pending requests in the Actions column.

Figure 72. Your Own Verifications tab

PAM

The PAM section is where you access secure company resources (PAM Targets). All sessions are recorded, and every action you take is digitally signed to ensure security and accountability.

Targets

The Targets tab displays a list of all PAM targets you have permission to access.

Figure 73. PAM Targets with possible actions: Connect to Target, View Target Details

Possible Actions:

• Connect to Target: Start a session with the selected PAM target. For detailed instructions, refer to the PAM Manual.
• View Target Details: See more information about the selected PAM target. As well as details about the target, you can review, download or delete the recording of previous sessions with this target.

Figure 74. View Target Details: General information about the PAM target

Figure 75. View Target Details: A list of all session recordings associated with the current PAM target.

Sessions

Sessions

The Sessions tab displays a list of your past and active PAM sessions. By default, all PAM sessions are logged for auditing purposes.

Possible Actions:

• Play Recording: Replay the session recording.

  

• Download Recording: Save a copy of the session recording to your computer as a .guac file.

• Download Typescript: Export the session transcript as a Typescript file.

Info

You can replay .guac files at https://player.glyptodon.com/ or convert them to MP4 using guacenc (https://github.com/litios/Guacenc-Docker).

Coming soon: You’ll be able to export recordings to standard video formats directly from the Dashboard. When this is available, the option to download .guac files will be removed.

Clicking on a session opens its details page, where you can download the recording or transcript. This page also includes a "File Transfers" table that logs all files uploaded or downloaded during the session.

Figure 76. File transfers overview

You can view and download any files that were uploaded during your PAM sessions.

Full-Text Search

You can search for any text that was typed or displayed during your past PAM sessions.

Figure 77. PAM Full-Text Search

Info

Clipboard-related context is included in full-text search results, ensuring better visibility of session activity.

Enter a term in the search bar, and any sessions containing that term will appear. Click the "Play" button next to a session to watch the entire recording. To jump directly to the moment the searched term appeared, click the "Play" button within the search result details.

Example

Searching for mkdir shows a session with 5 occurrences.

Clicking the 'Play' action opens a preview of the session recording, highlighting where the searched term was found.

SAML - Services Providers

This section shows all Service Providers (SPs) assigned to you by your administrator. To access one, click Login to Service Provider button in the Actions column.

Figure 78. SAML - Service Providers

Settings

About

This section shows the version information for the application's components.

Figure 79. About

---

This guide is for informational purposes only. The functionality and capabilities of individual parts of the Excalibur system depend on the installation, configuration, and system administrators, and may change with updates.