Home / Help centre / Authentication & logins
Authentication & logins
How do I add a login role to a scan profile?
In the profile form, open Authentication and click + Add role. Give the role a name and a privilege level, tick Form, Header or OAuth 2.0, and fill in the details for that method. Click Save. Add a second role if you want to test two kinds of account.
Steps
- Open a profile with + New profile, or the pencil icon on an existing one. Click Authentication in the switcher.
- Click + Add role. A card appears, headed "Role 1".
- Type a Name for the role. The placeholder is "admin", but use any name that tells your team which account this is.
- Choose a Privilege level: Unauthenticated, User, Elevated or Admin. User is the default.
- Under Authentication methods, tick one or more: Form (on by default), Header (token / API key) or OAuth 2.0.
- Fill in the block that opens for each method. For a form login, that means the login URL, username, password, a success condition and the login steps.
- Click Save.
Good to know
A role is the login identity the scanner uses. With no roles, the Authentication section reads "No auth roles. Add a role to scan behind login, or leave empty for unauthenticated scanning." So a role is only needed when you want to reach pages behind a login.
The in-app guide suggests a normal user and, for IDOR and privilege testing, a second user. Add one role for each account you want the scan to use. Use only accounts you are allowed to test with, and prefer test accounts to real customer accounts.
| Field | What to enter |
|---|---|
| Name | A label such as "support-user" |
| Privilege level | The level the real account has |
| Methods | How that account signs in: Form, Header or OAuth 2.0 |
Stored secrets are never shown again after you save. To delete a role, use the trash icon on its card. Next, read how to configure form login and how to set a privilege level. The tutorial is scan behind login with authentication roles.
Related questions
- How do I set a role's privilege level?
- How do I combine form login and a header token for one role?
- How do I set up form login for the scanner?
- How do I set up two user roles so the scanner can test access between accounts?
- How do I remove a login role from a profile?
How to scan behind login in Cyberlop with authentication roles
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Still stuck?
Tell us what you see on screen and an engineer will help you sort it out.