Post-Installation Checklist

Post-Installation Checklist#

After the installation completes, your Squirro instance is running but not yet secured or fully configured. Follow this checklist to create the first administrator, close the open sign-up exposure, set up authentication, and complete the configuration that production deployments require.

The steps apply to all deployment methods, including Ansible, Linux, and container installations.

Important

Complete steps 1 and 2 immediately after installation. Until you create the first administrator and turn off open sign-up, anyone who can reach the instance can create an account.

1. Create the initial administrator#

When a Squirro instance first loads, it presents a Sign Up button. The first user created becomes a server-level Administrator.

  1. Open the Squirro instance in your browser.

  2. Click Sign Up.

  3. Enter the account details and a strong, unique password. Squirro recommends generating the password with a password manager and storing the credentials in a secure shared vault.

  4. Submit the form to create the account and log in.

Treat this account as a fallback administrator account. When you configure Single Sign-On (see step 3), this account remains the fallback used to access the instance if the identity provider becomes unavailable.

For more information about server-level roles, see the Server-Level Permissions page.

2. Turn off open sign-up#

In its initial state, Squirro allows anyone to sign up. After you create the initial administrator, turn off the sign-up feature immediately to prevent unauthorized account creation.

  1. Log in as a server administrator.

  2. Navigate to the Server space.

  3. Click Configuration in the left menu.

  4. Search for frontend.userapp.signup.

  5. Hover over frontend.userapp.signup and click Edit.

  6. Clear the checkbox to turn off the option, then click the checkmark button to save.

Squirro disable sign-up configuration option

Note

Turning off sign-up does not lock you out. As a server administrator, you can still create accounts manually from the Users page in the Server space. Once Single Sign-On is configured (see step 3), the identity provider provisions users automatically. For more information about the Server space, see the Squirro Spaces page.

3. Configure authentication#

Production deployments should use Single Sign-On (SSO) rather than local accounts. Squirro supports SAML 2.0 for identity federation, along with third-party providers such as ADFS, Microsoft Entra ID (Azure), Google, and Okta, and OpenID Connect through JSON Web Tokens.

Plan the SSO integration with your IT team before deployment, and keep the fallback administrator account from step 1 available for cases where the identity provider is unreachable.

For setup instructions and supported providers, see the External Authentication page.

Warning

Verify that SSO login works with a test user before you rely on it. Keep the fallback administrator credentials from step 1 in a secure location so that you can still access the instance if the identity provider becomes unreachable.

4. Complete the required configuration#

Review the following configuration areas before moving the instance into production. SSL certificates are mandatory for any internet-facing deployment, and the remaining areas are strongly recommended.

  • SSL certificates

    Replace the self-signed certificate created during installation with a certificate trusted by your organization. For more information, see the SSL Certificates page.

  • Email

    Configure the outbound email server so that Squirro can send account notifications and alerts. For more information, see the emailsender.ini page.

  • Backup

    Set up regular backups of the database and search index so that the instance can be restored after a failure. For more information, see the Database Backup and Restore page.

  • Monitoring

    Set up monitoring to track the health and performance of the instance. For more information, see the Monitoring page.

Depending on the deployment, you may also need the following:

  • GenAI provider

    To use the AI features, configure access to a large language model provider. For more information, see the genai.ini page.

  • PDF viewer license

    If your deployment ingests PDF files, configure the PDF viewer license to display documents without a watermark. For more information, see the PDF Viewer page.

For the full set of administration options, see the Configuration and Operations pages.

Next Steps#

After the instance is secured and configured, create your first project and start loading data. For an overview of working with Squirro, see the Getting Started page.

Contents