User Management

Every person who signs in to Primentra needs a user account. Accounts are created and managed in Settings → Access Management → Users.

Watch it in 3:36 — the three badges, an account created and given a role, an address refused because it already exists, and the last administrator refused a switch-off:

The Users tab in Access Management, showing accounts with their roles, status and last password change(click to enlarge)

The user list

The list is a sortable table. Click any column header to cycle through ascending, descending, and unsorted.

Three badges can appear next to a name:

• Admin (crown) — the user belongs to a role with the Administrator flag
• System — Primentra's own account, see below
• API — an API service account, see below

Click a row to open the account. The action buttons on the right send the welcome email, edit the account, or delete it.

Create a user

1. Click New user.
2. Enter the Email. This is the login name and must be unique.
3. Enter the Display Name. It appears in the settings menu and the audit log.
4. Enter a Password, or click Generate for a random 16-character password. Use the eye icon to check it.
5. Leave User must change password at next login ticked if the user must choose their own password.
6. Leave Send welcome email ticked to mail the account details.
7. Under Sign-in status, leave Enabled ticked.
8. Tick the roles the user belongs to.
9. Click Create user.

The welcome email

The welcome email is branded HTML. What it contains depends on the Must change password setting.

Both versions list the user's role memberships.

To send it again later, click the mail icon on the user's row. A resent email never contains a password, because passwords are not stored in readable form.

Sending is non-blocking. If the mail server is unavailable, the account is still created and a toast reports the failure.

Edit a user

Open the account and change any field. Leave the password box empty to keep the current password. Role changes apply as soon as you save.

The Password last changed date is shown at the bottom of the form and cannot be edited.

Enabled and Locked out

The form has a Sign-in status box with two separate flags. Both block sign-in. Only an administrator can clear either one.

The list shows one badge per state: Active, Disabled (Enabled is off) or Locked out. A user can be Disabled and Locked out at the same time. Point at a badge to read the tooltip.

To unlock a user, open the account, untick Locked out and click Save. The user can sign in again and the failed-attempt counter goes back to zero. For a locked user the form shows *Locked on [date] after five wrong passwords.*

You cannot lock a user by hand. Locked out stays disabled unless the user is locked already. To block a user, clear Enabled.

Clearing Enabled and a lockout both end the open sessions of the user and cancel any unused sign-in links. Each real change is written to the audit log. A save that changes no flag writes nothing. See Account Security.

Delete a user

Deleting is a soft delete:

• The account is marked deleted and set to inactive.
• Role memberships, favorites, hidden entities, and personal settings are removed permanently.
• Audit log entries stay, so the history of what the user did remains readable.
• The email address becomes free again, because the uniqueness rule only covers accounts that are not deleted.

Primentra refuses any change that would leave the installation without an active administrator. Deleting the last administrator returns an error instead.

Accounts Primentra creates itself

Two account types appear in the list that nobody created by hand. Both carry a blue badge.

Neither account has a password, so neither can sign in. The email addresses are internal identifiers — no mail is ever sent to them.

Related

• Roles & Permissions — what each role may see and edit
• Authentication — how users sign in
• Account Security — lockout and password rules
• Email & Notifications — mail server settings
• REST API — API users and keys