Authentication & Access Control

Authentication & Access Control#

XCOMPUTE uses cryptographic credentials to enforce secure authentication, enabling you to connect with confidence. Each team’s administrator(s) control access to hosted projects.

Access Roles#

Role

Permissions

Requirements

Full User

Read/write, execute, import/export

Fingerprint + email approved by admin

Guest

Read-only, no file exports

Host must enable allow_guests=true

How Authentication Works#

Xplicit Web Services (XWS) issues credentials to access the XCOMPUTE network. Available and active fingerprints are listed in your Account Profile.

Upon downloading a package, a license and its associated fingerprint are generated. When first used, the license is mapped to a specific machine using X.509 key-certificate cryptography.

Required Credentials#

Two pieces of information are required for user authentication:

$email          # Human-readable identifier
$fingerprint    # License identifier (32-byte RSA hash)

Email#

A validated email address is required. Ensure you maintain secure access to this account.

Fingerprint#

A private key is generated for each XCOMPUTE license. Each private key has an associated fingerprint used to sign certificates and validate identities.

Keys and certificates are managed automatically, reissued every 31 days to maintain high-grade security.

  • If a valid key/cert pair is not found, XCOMPUTE will request a new set from XWS using your credentials.

    • $fingerprint.key # Digital license private key (permanent)

  • Certificates expire 31 days after issuance. Automatic renewal occurs as needed.

    • $fingerprint.crt # Semi-public certificate (transient, auto-renewed)

Machine Identifier (MASH)#

A third credential is provided by your computer: a machine identifier hash (MASH). This anonymously identifies the endpoint device.

Check your MASH using:

./xcompute-server --mash
# or
./xcompute-client --mash

Security Overview#

These three credentials (email, fingerprint, MASH) are never exposed by XCOMPUTE technologies and together form a robust security trifecta. Their strength depends on the security measures you maintain on your devices and accounts.

Network Encryption#

Our X.509 infrastructure provides 4096-bit security over WAN by establishing an AES/GCM encrypted connection via SSL/TLS handshake.

License Transfer#

If your MASH changes (e.g., hardware replacement) or you wish to transfer a license to another machine:

  1. Log in to your Account Profile.

  2. Locate the fingerprint associated with the old MASH.

  3. Copy the fingerprint into the Unassign Machine/License field.

  4. Click UNASSIGN to free the license.

  5. The license can now be reassigned to a new machine using the same email/account.

Troubleshooting Authentication

If authentication fails:

  • Clear expired keys/certs using the button in the Authentication Failure dialog.

  • Unassign the fingerprint in your account profile.

  • Relaunch the application to trigger a fresh key/cert request from XWS.