Help

Overview and roles

The suite is a single launchpad for every ARES application. Each application appears as a card with its name, address, description and category. Selecting a card opens the application.

What you can see and do depends on who you are:

Finding applications

Search

Type in the search box at the top of the suite page. It matches application names, descriptions, categories, web addresses and tags as you type.

• Press / anywhere on the page to jump to the search box.
• Press Esc while in the search box to clear it.

Categories

The row of buttons under the search box filters by category. Each button shows how many applications it holds. Select All to see everything again. With All selected and no search, applications are grouped under category headings.

Grid or list

The two buttons at the right of the search box switch between a grid of cards and a compact list. The suite remembers your choice on this device.

Light and dark theme

The half-filled circle in the header cycles between System, Light and Dark. System follows your device setting. The choice is remembered on this device.

Opening an application

Select a card to open the application. Most open in a new browser tab; an administrator can choose this per application. The suite only links to each application. Each application has its own sign-in where it needs one.

Signing in

Select Admin (or Sign in) in the header, or go to /admin. Accounts kept by the suite sign in with a password and a 6-digit code from an authenticator app, as described below. If your organisation has turned on single sign-on, you may sign in with your organisation account instead:

• Single sign-on button (for example Sign in with Microsoft): select it and sign in on your organisation's page. You come straight back to the suite.
• Directory (LDAP) account: type your usual network username and password in the normal form.

Your administrator decides whether the suite also asks for its own 6-digit code after an organisation sign-in. Passwords of organisation accounts are changed with your organisation's usual tools, not in the suite.

First sign-in: set up your authenticator

1. Enter the username and temporary password an administrator gave you, then select Continue.
2. Install an authenticator app on your phone if you do not have one, for example Google Authenticator, Microsoft Authenticator, 1Password or Authy.
3. Scan the QR code with the app. If you cannot scan, type the setup key shown under the code into the app instead.
4. Enter the 6-digit code the app shows and select Confirm & activate.
5. Save your 10 recovery codes. Select Copy codes to clipboard and keep them somewhere safe, such as a password manager. They are shown only once. Then select I have saved them — continue.

Then change the temporary password under My account.

Every sign-in after that

1. Enter your username and password and select Continue.
2. Enter the current 6-digit code from your authenticator app. It is submitted as soon as six digits are entered.

If you do not have your phone

On the code step, select Use a recovery code instead and enter one of your saved recovery codes. Each code works once. Afterwards, generate a new set under My account. If you have no recovery codes left, ask an administrator to reset your two-factor device.

Staying signed in

A sign-in lasts up to 12 hours. Select Sign out in the console header when you finish, especially on a shared computer.

Private links and documents

Once you are signed in, the suite page shows Private applications alongside the public ones. Private cards carry an amber Private tag.

All, Public and Private views

When signed in, a switch next to the search box shows All, Public or Private, each with a count. All shows both kinds together. The suite remembers your choice on this device.

Application documents

An application can have two documents: an Executive summary and an Architecture document. When it has them, buttons appear at the bottom of its card:

• 📄 Summary or 📄 Architecture opens the document. PDFs, images and text open in a new browser tab. Word, PowerPoint and Excel files download, because browsers cannot display them.
• ↓ next to a document always downloads it.

Documents are visible only to signed-in accounts and to people an application has been shared with.

Your account

In the console, open the My account tab. Users see only this tab.

Change your password

1. Enter your current password, then the new password twice.
2. Select Update password.

A password needs at least 12 characters, with an upper-case letter, a lower-case letter and a digit. Changing it signs you out on every other device.

Generate new recovery codes

Enter your password and select Generate new recovery codes. You get a fresh set of 10 and the old ones stop working. A warning appears in the console when you have two or fewer left.

Move to a new phone

Enter your password and select Reset two-factor device. This removes your current authenticator and signs you out. At your next sign-in you set up the new phone as on your first sign-in.

Opening a shared link

If an administrator shared an application with you, you received an email titled “[name] shared [application] with you”. You do not need an account, username or password.

1. Select Open shared application in the email, or paste the address it contains into your browser.
2. The page shows the application, any message from the sender, and how long your access lasts.
3. Select Open application ↗ to go to the application itself. It may ask you to sign in there separately.
4. Under Documents, select Open or Download.

The link stops working at the time shown on the page and in the email, or earlier if the sender withdraws it. Do not forward the link: anyone who has it can open the page until it expires. If it has expired, ask the sender for a new one.

The admin console Administrators

After signing in, administrators see five tabs:

The header shows who is signed in and has View suite ↗, Help, About and Sign out.

Adding and editing applications Administrators

Add an application

1. On the Applications tab, select + Add application.
2. Fill in the form:
   • Name (required): shown as the card title.
   • Category: groups the card on the suite page and creates a filter button. Pick an existing one from the suggestions or type a new one. Empty means “General”.
   • URL (required): the application's address. https:// is added if you leave it out. Only http:// and https:// links, or paths starting with /, are accepted.
   • Description: one or two lines shown on the card.
   • Icon: see Icons. Without one, the card shows the name's initials.
   • Tags: comma-separated words. The first three show on the card, and all of them are searchable.
   • Visibility: Public, Private or Hidden. See Visibility.
   • Open in a new tab: on by default.
3. Select Save application.

Edit or delete

Each row has Edit, Docs & share and Delete. Deleting an application also deletes its documents and ends its share links. It cannot be undone.

Change the order

Drag a row by the ⠿ handle on its left and drop it in a new position. The order is saved straight away and is the order cards appear in within each category on the suite page.

The Docs & share badge

The Docs & share button shows 📄 with the number of uploaded documents and 🔗 with the number of active share links.

Visibility Administrators

Visibility controls what the suite lists. It does not protect the application's own site. Anyone who knows an application's address can still visit it.

Icons Administrators

In the application form, select Choose icon…. The dialog has four tabs:

• Brand logos and Symbols: over 5,400 built-in icons. Type in the search box, for example “grafana”, “docker” or “shield”, then select one.
• Emoji: type any emoji or up to 16 characters.
• Upload: drop or choose your own PNG, JPEG, WebP or GIF image, up to 1 MB. It is resized to fit. Uploaded icons can be reused on other applications, and unused ones can be deleted from this tab.

Select Clear next to the icon to go back to initials.

Documents Administrators

Each application has two document slots: Executive summary and Architecture.

1. On the Applications tab, select Docs & share on the application's row.
2. Under Documents, select Upload next to a slot and choose the file.
3. To change a document, select Replace. To take it away, select Remove.

Accepted files: PDF, Word (.docx), PowerPoint (.pptx), Excel (.xlsx), PNG, JPEG, WebP, GIF, Markdown and plain text, up to 25 MB each. The suite checks the actual file contents, so a renamed file of another type is refused. SVG and HTML files are not accepted, for security.

Who can open documents: every signed-in User and Administrator, from the cards on the suite page, and anyone with an active share link for that application. Documents of a Hidden application are visible to administrators only.

Sharing by email Administrators

Share an application with someone who has no account. They get a link by email that works without a username or password until a time you choose.

Share an application

1. Select Docs & share on the application's row.
2. Under Share by email, enter the Recipient email.
3. Choose the Access period: 1 hour, 4 hours, 24 hours, 3 days, 7 days or 30 days. Or choose Until a date and time… and pick the moment, in your local time, between 15 minutes and 90 days from now.
4. Optionally add a Message. It appears in the email and on the shared page.
5. Leave Email the link to the recipient ticked, then select Create share link.

A confirmation shows whether the email was sent, plus the link with a Copy button. This is the only time the link is shown. Copy it if you want to send it another way, for example in a chat message. Untick the email option to create a link without sending an email.

What the recipient gets

A page with the application's name, description, your message, an Open application button and its documents, with a countdown to when access ends. See Opening a shared link.

Track and revoke

The Share links list in the same dialog shows each recipient with:

• Status: Active, Expired or Revoked.
• When it ends, whether the email was sent, how many times it was opened and when, and who created it.

Select Revoke to stop a link immediately. To give someone more time, create a new share; an existing link's period cannot be extended.

If the email does not arrive

Ask the recipient to check their spam folder. If the confirmation said the email could not be sent, or the email option is greyed out, the server could not send mail. Revoke that share, create a new one with the email option unticked, and send the copied link yourself.

Administrators and users Administrators

Roles

• User: signs in to see private applications and documents, and manages only their own account.
• Administrator: full access to the console.

Add an account

1. On the Administrators tab, select + Add user.
2. Enter a Username (3 to 32 letters, digits, dots, underscores or hyphens), an optional Display name, the Role, and a Temporary password.
3. Select Create user, then give the person their username and temporary password through a safe channel.

The person sets up their authenticator at their first sign-in.

Assign a role

Change the Role drop-down on the account's row, or select Edit. A change takes effect on the person's next action, without signing them out. Use the All, Administrators and Users buttons above the table to filter the list.

Other actions on an account

Safeguards

• You cannot change your own role, disable yourself or delete yourself.
• The last active Administrator cannot be demoted, disabled or deleted, so the suite always has someone who can manage it.
• Change your own password and two-factor device under My account.

Suite settings Administrators

On the Suite settings tab, change the Suite title and Subtitle shown at the top of the suite page and in the browser tab, then select Save settings.

Single sign-on Administrators

The Single sign-on tab lets people sign in with their organisation account. Two methods can be used together:

• SAML 2.0: a sign-on button on the sign-in page. Works with Microsoft Entra ID, Okta, ADFS, Google Workspace, Keycloak and any SAML 2.0 identity provider.
• LDAP / Active Directory: directory usernames and passwords are accepted on the normal sign-in form.

Keep at least one Administrator with a suite password. Suite passwords always keep working, so that account is your way in if the directory or identity provider is unavailable or misconfigured. A suite password account always takes precedence over a directory account with the same username.

Set up SAML with Microsoft Entra ID

1. On the Single sign-on tab, check Suite address (for example https://ares.example.com). The values to give Entra appear below it, each with a Copy button.
2. In the Microsoft Entra admin center, open Enterprise applications → New application → Create your own application and choose the non-gallery option.
3. Open Single sign-on → SAML. In Basic SAML Configuration, paste the Identifier (Entity ID) and Reply URL, and set Sign on URL to the sign-on URL shown in the suite.
4. Under SAML Certificates, download Federation Metadata XML. Back in the suite, select Choose XML file… (or paste it and select Read metadata). The sign-in URL, identifier and certificate are filled in.
5. Optional, to manage roles from Entra: in Attributes & Claims add a group claim. Entra sends group Object IDs; paste them into Administrator groups and Allowed user groups.
6. In Entra, under Users and groups, assign who may use the suite.
7. Tick Show a single sign-on button on the sign-in page and select Save SAML settings. Test in a private browser window before signing out.

Other identity providers work the same way: give them the Entity ID and Reply URL (or the Metadata URL), then import their metadata. If their attribute names differ from Entra's, change them under Attribute names.

Set up LDAP / Active Directory

1. Enter the Server URL. Use ldaps:// (port 636), or an ldap:// address with Use StartTLS, so passwords are encrypted on the network. If the directory uses an internal certificate authority, paste its certificate under Custom certificate authority.
2. Enter a read-only Bind account and its password, and the Search base (for example DC=example,DC=com). The bind password is stored on the server and never shown again; leave the box blank to keep it.
3. The default User filter finds Active Directory and OpenLDAP accounts by username. For OpenLDAP, set the username attribute to uid.
4. Under Test the connection, enter a username (and optionally their password) and select Test connection. Each step is shown, with the person's details, groups and the role they would get.
5. Tick Accept directory usernames and passwords on the sign-in form and select Save LDAP settings.

Accounts and roles

• Administrator groups: members become Administrators. Allowed user groups: when filled in, only members of these (or of the administrator groups) may sign in. For LDAP a group can be its full DN or just its name.
• With either group box filled in, the role follows the groups at every sign-in. With both empty, new accounts are Users and you set roles on the Administrators tab. The last active Administrator is never demoted this way.
• Create an account automatically at first sign-in: when off, add people yourself on the Administrators tab with the sign-in method LDAP or SAML single sign-on and the username the directory or identity provider uses (often an email address). The account is linked at their first sign-in and shows waiting until then.
• To move an existing suite-password account to single sign-on, edit it and change its Sign-in method. To move it back, choose the password method and give a temporary password.
• Also ask for this suite's 6-digit code: recommended for LDAP, where the directory password is the only other factor. For SAML, the identity provider usually enforces multi-factor sign-in already.
• Allow sign-in started from the identity provider: needed for the Microsoft My Apps tile. Off by default, which accepts only sign-ins that start at the suite.

Every SSO sign-in, refusal, account creation and role change is recorded in the Activity log.

Activity log Administrators

The Activity log tab lists the most recent 200 events, newest first, with time, account, action, target, detail and IP address. It records:

• Sign-ins, failed sign-ins, two-factor events and sign-outs.
• Every change to applications, icons, documents and settings.
• Account changes: creation, role changes, password and two-factor resets, disabling and deletion.
• Share links created and revoked, including the recipient and end time.

Security rules

Troubleshooting

I am signed in but cannot see a private application.

Reload the suite page. Check the view switch is on All or Private, and that no category or search is filtering it out. If it is still missing, ask an administrator to check its Visibility is Private, not Hidden.

My authenticator code is refused.

Codes change every 30 seconds and depend on your phone's clock. Turn on automatic date and time on the phone and use the newest code. If you no longer have the app, use a recovery code.

I lost my phone and my recovery codes.

Ask an administrator to use Reset 2FA on your account. You set up a new authenticator at your next sign-in.

I forgot my password.

Ask an administrator to use Reset password. Then change the temporary password under My account.

Single sign-on says my account “already exists” or I “do not have an account yet”.

The suite never takes over an account that uses a suite password. Ask an administrator to change your account's sign-in method to single sign-on, or to add you, on the Administrators tab.

Single sign-on says the response “could not be verified”.

Try again from the suite's sign-in page. If it keeps happening, an administrator should check that the certificate and identifier on the Single sign-on tab match the identity provider (it may have rolled over its certificate), and that the server's clock is correct.

My directory (LDAP) password is refused.

Use the username you use for your network sign-in. If the suite says the directory server could not be reached, ask an administrator to run Test connection on the Single sign-on tab.

“Account temporarily locked”.

Wait 15 minutes, or ask an administrator to select Unlock on your account.

A document downloads instead of opening.

Word, PowerPoint and Excel files always download because browsers cannot display them. PDFs, images and text open in the browser.

A shared link says it has expired or been withdrawn.

The access period has ended or the sender revoked it. Ask the sender for a new link.

The share email never arrived.

Check the spam folder. An administrator can create a new link without the email option and send the copied link another way.

The page looks out of date after an update.

Reload with Ctrl + Shift + R, or ⌘ + Shift + R on a Mac.

About this suite

Select About in any page header to see the authors, the version running on this server, and what changed in recent releases.