@apnar, @xlurkr, eisy can run without connectivity, and it will stay that way. We have customers that need to run it in completely disconnected environments, and that won't change.
Currently, it can be confusing to use eisy. You need to use the admin console, PG3x, IoX and portal... and sometimes you need to use portal creds, sometimes IoX creds. In PG3x in particular, you need a double login, one locally and one to portal (System | Switch portal profile).
With eisy-ui, one of the design direction is to simplify all this by providing a single interface with one set of credentials for everything, all while allowing to run completely disconnected.
But how can you use portal creds and run disconnected you may ask?
When you login to eisy-ui, if there is connectivity, it will validate the creds against portal. In addition, when you login, the creds are cached locally. If you attempts to login and eisy has no connectivity, login will work against the local copy of the creds. When you login "locally", cloud features will be disabled. The only requiremnent to use eisy-ui is that it must have had connectivity at least once. For corporate customers, this is done during provisioning.
What I describe above is partially implemented in the current eisu-ui release 0.4.3. It is implemented in dev, you will be able to test it in the next release.
FYI, portal creds cached locally are hashed, so if an eisy is compromised, your portal creds can't be discovered.