Users and Permissions
There are two global roles:
- admin — manages the instance: users, teams, core settings, portal messages, all projects.
- user — works exclusively through project memberships.
Under Administration → Users, accounts can be created, edited, invited by email (with a generated password), reset, and imported from CSV. If no mail relay is configured, the interface shows the generated password once.
Forgot your password
Section titled “Forgot your password”The sign-in page offers Forgot your password? — provided a mail relay is
configured (smtp.host and smtp.from). Without one the link would never
arrive, so the interface hides the entry point and resetting stays with the
administrators.
The flow: enter your address, receive a link, set a new password. What is deliberate about it:
- The answer is always the same. The server never says whether an account exists for an address — otherwise the page would be a directory service for other people’s addresses, without any sign-in.
- A link is valid for 30 minutes and works exactly once. A new link voids the previous one, and a second request within a minute sends no second mail (or the page would be a way to flood someone’s inbox).
- A new password ends all open sessions of that account. Whoever resets a password may have lost access — then whoever currently holds it should be signed out too. A confirmation mail follows.
In the cloud the password belongs to the home organisation: someone who is a member of several organisations resets exactly the one password the sign-in checks.
A team is a named group of users. Sharing a project with a team reaches all its members — saving individual grants when people come and go.
Projects and roles
Section titled “Projects and roles”Access grants apply at the project level:
| Role | May |
|---|---|
| Owner | everything, including deleting and transferring ownership |
| Manager | manage the project: members, grants, and provider accounts |
| Editor | edit zones and record sets (including Sync Groups, Templates) |
| Visitor | read only |
The personal base project cannot be shared or deleted.
Restriction to individual zones
Section titled “Restriction to individual zones”A grant as Editor or Visitor can additionally be limited to specific zones of the project (selected in the member dialog). Then:
- The role applies only to the selected zones.
- All other zones of the project are invisible to this member — including in the Inventory and in search.
- Project-wide things like accounts remain readable but not modifiable.
Manager grants cannot be restricted: whoever manages the project manages it entirely.
Two-factor login
Section titled “Two-factor login”Every user can secure their account under My Profile → Two-Factor Authentication with a time-based one-time code (TOTP, RFC 6238):
- Set up 2FA shows the secret and the
otpauth://URI for the authenticator app. - A valid code from the app arms it.
- From then on, signing in requires the code in addition to username and password.
Disabling requires the current password — a stolen session alone is not enough to switch off the second factor.
API keys
Section titled “API keys”For automation there are API keys with limited access — bound to a project with a project role, or instance-wide with scopes. Details under API and Automation.