Set up user credentials with AI Sign-in

User credentials tell Astra how to sign in to a web application so that scans and pentests can test the pages behind a login. When Enable AI Sign-in is turned on for a target, an AI agent signs in as each user credential, and Astra checks every user credential before a scan uses it.

This article covers how to turn on AI Sign-in, what happens to existing login details when it is turned on, how to add a user credential, and how the new setup differs from the previous login form.

Before you begin

• AI Sign-in is available for web application targets whose plan includes Autonomous Pentest or Hybrid Pentest.

• Enable AI Features must be on for the target. The Enable AI Sign-in switch appears only while Enable AI Features is on.

• Targets without AI Sign-in continue to use the previous login form under User Credentials.

Turn on AI Sign-in

1. Open the target and go to Basic Information in the target settings.

2. Make sure Enable AI Features is on.

3. Turn on Enable AI Sign-in ("Enable AI to sign in with the user credentials you add for this target").

4. Click Save Changes.

After the change is saved, the User Credentials page of the target shows the new user credential screens.

Note: Turning off Enable AI Features also turns off Enable AI Sign-in.

What happens to existing login details

When Enable AI Sign-in is turned on for a target that has no user credentials yet, Astra copies the target's existing login details into the new setup:

• Each role from the previous Testing Credentials list becomes a user credential, with the same name, username and password.

• Privileged User becomes Privileged, and Normal User becomes Non-Privileged.

• Each copied user credential uses the Username + Password login method.

• The target's existing login recording and custom script are attached to the first copied user credential only.

• Astra then starts a sign-in check for each copied user credential.

A copied user credential that has no login recording or custom script shows Incomplete until Sign-In Instructions are added to it. Open it with Edit, add the instructions and click Save and verify.

If the target already has user credentials, nothing is copied and the existing user credentials are kept as they are.

Add a user credential

Add one user credential for each level of access in the application, for example an administrator and a regular user. If the application serves separate customers or organizations, add user credentials from more than one of them.

When the target has no user credentials yet, the User Credentials page shows the three parts of the setup and an Add User Credentials button.

1. Go to User Credentials in the target settings and click Add User Credentials.

2. Under Login Method, choose how this account signs in, the same way it does on the application's login page.

• For SSO methods, Microsoft is available as the Sign-In Provider. Google is marked Coming soon.

• Password + Email Code, Email Code and Magic Link are marked Coming soon and cannot be selected yet.

• Authenticated Header has to be the only user credential on the target. It cannot be combined with other login methods.

3. Under Account Details, fill in the following:

   • User Credential Name: a name for this level of access, for example Admin.

   • Privilege Level: Privileged for an account that manages the app for others, such as adding users or changing settings, or Non-Privileged for an account that does everyday work in the app with its own access.

   • The sign-in fields for the chosen login method, such as Username and Password.

   • Sign-In Instructions: the steps to sign in, one action per line, ending on the step where the signed-in page is showing.

Note: Sign-In Instructions are required unless a login recording or custom script is added under Additional Details.

4. Optionally, open Additional Details and upload a Login Recording or a Custom Script (a Puppeteer script that signs in). Use these when the sign-in is easier to show or script than to describe. The agent follows the instructions first, then the script, then the recording.

5. Click Save and verify. Astra saves the user credential and starts a sign-in check.

Fields marked with an asterisk (*) are required. To add more user credentials, click Add User Credentials again.

If the sheet is closed before saving: a Leave Without Finishing? dialog appears when there are unsaved changes. Discard changes closes the sheet without adding anything to the page, and Keep editing returns to the form. A user credential appears in the list only after Save and verify is clicked.

Check the sign-in status

Every saved user credential is listed on the User Credentials page with its Privilege Level, Login Method, Additional Details and Status.

A scan uses a user credential only after it is Verified. If any user credential still needs details, a notice at the top of the page shows how many need to be finished.

View the result of a check: open the row menu and select View Verification Status. A successful check shows "Astra signed in as" followed by the user credential name, with a screenshot of the signed-in page. A failed check shows "Astra could not sign in as" followed by the user credential name, and the reason. A screenshot proof will also be added in the sheet.

Fix a failed check: update the sign-in details in the same sheet, then click Save and verify to run the check again.

Manage user credentials

The row menu of each user credential has the following actions:

• View Verification Status: opens the result of the latest sign-in check.

• Verify Again: runs the sign-in check again without changing any details.

• Edit: opens the user credential to change its details. This option is not shown while a check is In progress.

• Duplicate: starts a new user credential with the same login method and account details. The login recording and custom script are not copied.

• Delete: removes the user credential from the target.

How the new setup differs from the previous login form

Targets without AI Sign-in use the previous form under User Credentials: one login recording or custom script for the whole target, and a Testing Credentials list with a Role type, name, Username and Password for each role, saved with Save Changes.

Turn off AI Sign-in

To go back to the previous login form, turn off Enable AI Sign-in on Basic Information and click Save Changes.

• The User Credentials page shows the previous login form again, with the target's earlier login recording, custom script and testing credentials.

• User credentials added in the new setup are not deleted. They are shown again if Enable AI Sign-in is turned back on.

• Changes made in the new setup are not copied back to the previous login form.