Users

Overview

The Users page lets you manage every login account on the platform. From here you can create new users, edit existing accounts, change passwords, assign users to permission groups, unlock locked accounts, switch accounts between active and inactive, and delete accounts.

User management requires the Users / Groups permission. Accounts marked Master admin (such as the built-in superadmin account) are protected: they cannot be edited, deleted, deactivated, or unlocked from this page. The only action available on a Master admin account is changing its password. The server enforces the same protection, so these changes are refused even when they are requested outside this page (see Master Admin Protection).

How to Open This Page

1. Click Administration in the top navigation bar.
2. Click the Users tab in the strip of administration sections at the top of the page.

You can also open the page directly at /administration/users.

Main Areas

Click to enlarge

• 1 Administration tabs - switch between the administration sections. The active section (Users) is highlighted. Only the sections your permissions allow are shown.
• 2 Add user button - opens the form to create a new account.
• 3 Total counter - shows how many accounts exist (for example, Total: 5 items).
• 4 Search field - filters the list by username or email.
• 5 User table - one row per account, with the columns Username, Email, Groups, Active, and Actions.

User Table

Status Badges

Badges under the username tell you about the account’s special state at a glance:

Action Buttons

The buttons in the Actions column are icon buttons. Hover a button to see its name.

For regular accounts:

For Master admin accounts:

Only the Change password button (key icon) is available.

Searching

Type in the Search by username or email… field to filter the table as you type. The search matches any part of the username or email and is not case-sensitive.

Click to enlarge

• While a search is active, the counter changes to Matching this page: X of Y · page N of M.
• The search filters only the accounts on the current page of the list. If you have more than one page of users, move to another page to search it as well.
• To clear the search, click the × button at the end of the field, or press Esc while the cursor is in the field.
• If nothing matches, the table shows No users match “…” with a hint to check the spelling.

Pagination

The list shows 8 accounts per page. When there are more accounts than fit on one page, a pagination bar appears in the toolbar between the Add user button and the search field. Use the page numbers and arrows to move between pages. When all accounts fit on one page, the pagination bar is hidden.

Creating a User

1. Click the Add user button at the top of the list.
2. A form titled Add user opens.

Click to enlarge

Click to enlarge

3. Click Save to create the account, or Close (or the × in the title bar) to cancel.

If a field is not valid, an error message appears in red under that field and the form stays open. Correct the highlighted fields and click Save again.

Click to enlarge

Typical messages are Must have a length between 4 and 255 (username), The email must be a valid email address., a message naming the missing character type for a password that does not meet the rules, Passwords does not match!, and username must not contain duplicates for a username that is already taken.

On success, the form closes, a confirmation notification appears in the top-right corner, and the list refreshes. New accounts are created active.

Password Rules

Every password (both when creating an account and when changing a password) must meet all of the following rules:

• At least 6 characters long.
• At least one uppercase letter (A–Z).
• At least one lowercase letter (a–z).
• At least one number (0–9).
• At least one special character (such as !, @, #, $, %).

Editing a User

1. In the user list, click the Edit user button (pencil icon) on the row you want to change.
2. A form titled Edit user · <username> opens, pre-filled with the current values.

Click to enlarge

The edit form has no password fields. To change a password, use the Change password action instead.

3. Click Save to apply the changes, or Close to cancel.

When you save, the user’s group assignments are replaced with exactly the groups selected in the form. If you clear the Groups field, the user loses all group-based permissions.

Changing a Password

1. In the user list, click the Change password button (key icon) on the row of the account.
2. A form titled Change password · <username> opens.

Click to enlarge

Click the eye icon at the end of either field to show or hide what you typed.

3. Click Save to set the new password, or Close to cancel.

On success, the form closes, a confirmation notification appears, and the list refreshes in place (your own session, scroll position, and search are kept). The account must use the new password the next time it signs in.

This is the only action available on Master admin accounts, and only a Master admin can change the password of a Master admin account. Anyone else gets the error Only a Master admin can change the password of a Master admin account.

Deleting a User

1. In the user list, click the Delete user button (trash can icon) on the row of the account.
2. A confirmation dialog appears, titled Delete <username>?, with the message This permanently removes the account and cannot be undone.

Click to enlarge

3. Click Yes, continue to delete the account, or Cancel to keep it. Cancel is focused by default, so pressing Enter right away does not delete anything.

Deleting a user permanently removes the account and all of its group memberships. This action cannot be undone. On success, a confirmation notification appears and the list refreshes.

Master admin accounts cannot be deleted. The server refuses such a request with Master admin accounts cannot be deleted.

Activating and Deactivating a User

Each regular account has a switch in the Active column.

• On - the account is active and the user can sign in.
• Off - the account is inactive and the user cannot sign in.

Click the switch to change the status. The change is saved immediately (there is no confirmation dialog). A small icon next to the switch shows the result:

Click to enlarge

Deactivating a user does not delete the account or its group memberships. You can reactivate it at any time by switching it back on.

Master admin accounts are always active; their Active column shows a dash (—). A request to deactivate one is refused with Master admin accounts cannot be deactivated.

Unlocking a User

When an Account Is Locked

The platform locks an account automatically after 5 failed sign-in attempts in a row:

• Each wrong password for the account counts as one failed attempt. The fifth one locks the account.
• While the account is locked, the user cannot sign in, even with the correct password. The login form shows This account is locked after too many failed sign-in attempts. Ask an administrator to unlock it. (see Getting Started).
• A successful sign-in before the limit is reached resets the count to zero.
• The lock does not expire on its own. An administrator must unlock the account.
• Master admin accounts are never counted or locked, so the built-in superadmin account can always sign in with its correct password.

A locked account shows the Locked badge under its username and an extra Unlock user button (green open padlock) in its Actions column.

Click to enlarge

Unlocking the Account

1. Click the Unlock user button.
2. A confirmation dialog appears, titled Unlock <username>?, with the message The user will be able to sign in again immediately.

Click to enlarge

3. Click Yes, continue to unlock the account, or Cancel to leave it locked.

On success, the notification The user <username> has been unlocked. appears in the top-right corner, and the list refreshes: the Locked badge and the Unlock user button disappear.

Click to enlarge

Unlocking also resets the account’s failed-attempt count, so the user again has 5 attempts before the account is locked. The user’s password does not change. If the user has forgotten it, set a new one with Change password.

The unlock button only appears for accounts that are currently locked. Master admin accounts are never locked and cannot be unlocked; an unlock request for one is refused with the error Master admin accounts are never locked and cannot be unlocked.

Master Admin Protection

The server checks every user and group change against the Master admin accounts and refuses the change, with an explanation, in these cases:

When several permissions would be lost, the message lists all of them (the “A”, “B” permissions). Group edits, group deletion and group deactivation are checked the same way (see Groups). The refused change is not saved, and the error appears in the Error on performing operation! dialog.

Notes

• All user management operations require the Users / Groups permission. If you do not see the Users tab, ask your administrator to add you to a group that has this permission (see Groups).
• The built-in superadmin account is a Master admin: it always exists, is always active, and always has full access. The only action you can perform on it is changing its password, and only a Master admin can do that.
• Usernames must be unique across the platform. Creating or renaming a user to an existing username produces a validation error.
• A user who belongs to no group (or only to disabled groups or groups without permissions) has no administration permissions and can only use the pages that need no permissions, such as Stats, Actions, Notifications, and Attacks.
• Group membership changes affect a user’s permissions the next time that user signs in.
• Account lockout. 5 failed sign-in attempts in a row lock a regular account until an administrator unlocks it. Changing the password or deactivating and reactivating the account does not clear a lock; use Unlock user.
• Success notifications appear briefly in the top-right corner and close on their own after about 1.5 seconds.
• Errors appear in a centered dialog titled Error on performing operation! with a Dismiss button.

Related Pages

• Groups - manage the permission groups that users can be assigned to.
• Administration - overview of all administration sections.