Onboard a client

A client is one of your customers. A client proxy is a Teleport agent installed at their site: it connects outbound (port 443) to your Teleport cluster and exposes their Windows and Active Directory servers over RDP. Tenantry organises everything around these proxies.

Use New client (on the Clients page and on the dashboard, administrators only). It opens a guided journey that chains the existing screens in the right order, each one with the client already filled in. You can leave at any time and come back from the client page.

The five steps

Step	What happens	Detailed page
1. Register	Code, name and contacts. The code is a slug (acme, dupont-sa) carried by the client_code label of the client's proxies and desktops. It cannot change later.	Clients and consoles
2. Connect their servers	Install a Teleport proxy at the client's site with the Add a proxy wizard. The client code is prefilled.	Two wizards below
3. Publish Steward	Publish the client's Steward (Active Directory console) as the Teleport application <code>-steward.	Publish Steward
4. Monitor the console	Add the Steward console to the fleet: URL, fleet token (Steward, Configuration, Fleet access, starts with stf_) and the CA if private.	Clients and consoles
5. Give access	Create the tenantry-client-<code> Teleport role, then assign technicians.	Technicians

Steps 2 to 5 can be skipped and done later.

The two Add-a-proxy wizards

Add a proxy offers two wizards.

Wizard	When	Page
New proxy + Active Directory	A new Linux gateway at the client, plus Active Directory (LDAPS) and discovery of the domain's Windows servers	Gateway + AD
Add servers to an existing proxy	The gateway already exists; add non-domain Windows servers as static hosts	Existing gateway

Both generate commands to run on the client's servers. Those commands call back Tenantry (/api/i/... and /api/callback/...), so the client's servers must be able to reach those two paths. Behind Cloudflare Access, add the Bypass application (Exposure).

Pick the public URL carefully

Tenantry's public URL is what appears in the generated irm and curl commands. It must be reachable from the client's servers, never localhost.

Running the fleet

Once proxies are connected, the Client proxies page shows their status, version, desktops and lets administrators lock them: Client proxies. The Clients and AD consoles pages give the per-client view: Clients and consoles.

The per-client checklist

The client page (/clients/<code>) shows a checklist computed from the real state, never from stored progress:

Item	Done when
Client registered	The code is in the register.
Client proxy online	A gateway of the client is online (offline: Needs attention).
Windows servers discovered	The client's proxies serve at least one desktop.
Steward published and served	A Teleport application carrying the client code is online.
Console polled successfully	One of the client's consoles answered its last poll (failing: Needs attention).
Teleport role created	The role tenantry-client-<code> exists (unknown when the cluster cannot tell).
Technicians assigned	At least one technician is assigned to the client (visible to administrators only).

Items that cannot be read (fleet or cluster unreachable, no right to list technicians) show as Unknown, never as missing. Continue opens the journey at the first step that is still missing or failing.