Security Hardening

Restricting OAuth Redirect URIs

Restricting the OAuth redirect URIs for the detect-client Keycloak client to your organization’s known, trusted domains is a security best practice. It prevents an authorization code from being redirected to an untrusted location during login. By default, the detect-client allows any redirect URI; before deploying to production, restrict this to the explicit domain(s) your Gemini Detect instance is served from.

To restrict the redirect URIs, open the Admin Console (see Admin Console) and:

  1. Navigate to Clients.

  2. Select detect-client.

  3. Open the Settings tab.

  4. Under Access settings, find Valid redirect URIs.

  5. Replace the wildcard (*) with the explicit URL(s) for your Gemini Detect instance, for example https://<your-domain>/*.

  6. Click Save.

../_images/redirect-uri-restriction.png

Valid Redirect URIs

Setting Up Multi-Factor Authentication (TOTP)

Enabling time-based one-time password (TOTP) multi-factor authentication adds a second layer of protection beyond a password, and is recommended for all accounts, especially admins. TOTP can be set up at any time from the Account Console — it does not need to happen during first login.

To set up TOTP, open the Account Console (see Account Console) and:

  1. Navigate to Account security > Signing in.

  2. Under Two-factor authentication, select Set up Authenticator application.

  3. Install an authenticator app on your mobile device (for example, Google Authenticator, Microsoft Authenticator, or FreeOTP) and scan the displayed QR code with it.

  4. Enter the one-time code generated by the app, optionally provide a Device Name, and click Submit.

../_images/totp-setup.png

Setting Up an Authenticator Application