Users and sign-in
Copy link to the page “Users and sign-in”Everyone who signs in to the appliance has a login with one of four roles. Users are managed under Users and login › Users, which only administrators can see.
Sign in with sslbrain Cloud
Copy link to the section “Sign in with sslbrain Cloud”-
Click Log in with sslbrain Cloud on the sign-in page.
-
Sign in to sslbrain Cloud with a password, GitHub, Google or Microsoft. If the account has two-factor authentication, you are asked for it.
-
sslbrain Cloud sends you back to the appliance with your role on this particular appliance.
You can also type your Cloud password straight into the sign-in form. A Cloud account created with GitHub, Google or Microsoft has no password, so use the button.
The role is fetched from sslbrain Cloud at every Cloud sign-in:
| In sslbrain Cloud | Role on the appliance |
|---|---|
| Owner of the account | Owner |
| Member of this particular appliance | The role the member has in Cloud |
| Administrator on the account | Administrator |
| Anyone else, including the Billing role | No access |
Change a Cloud user’s role in sslbrain Cloud under Team, see sslbrain Cloud. A role changed under Users is reset at the user’s next Cloud sign-in.
Every sign-in, sign-out and failed sign-in is written to the audit log.
Create a user on the appliance
Copy link to the section “Create a user on the appliance”If a colleague should sign in with their sslbrain Cloud account, invite them in sslbrain Cloud under Team. If they only need a login on the appliance, create a local user:
-
Open Users and login › Users and click Add user.
-
Fill in username, email, password and role. The password must be at least 10 characters. Email is required, even though the field is labelled Email (optional).
-
Click Create user. Confirm your own sign-in if the appliance asks.
The user signs in with email and password.
Local password
Copy link to the section “Local password”With a local password, a user signs in without the appliance asking sslbrain Cloud. Give at least one user a local password, so there is a way in when sslbrain Cloud cannot be reached.
-
Open the user menu at the top and choose Local password.
-
Type the new password twice. It must be between 10 and 200 characters. If the account already has a local password, type the current one as well.
-
Click Save password.
The account is then a local account on this appliance. The Log in with sslbrain Cloud button still works for it.
An administrator can set another user’s password with Edit under Users, after confirming their own sign-in. If Admin Local sets the password, it cannot be used to confirm that user’s sign-in afterwards, see Admin Local.
Each role can do everything the role above it in the table can. The role names are in English on the appliance and in sslbrain Cloud.
| Role | Can |
|---|---|
| Viewer | View the overview, certificates, servers, the audit log, the settings pages (without changing them) and Support. |
| Operator | The same, plus: create and edit servers, credentials, profiles and certificates (including upload), create and run rules, rerun deployments, create alert channels and alert rules, edit sources, run discovery and TLS scanning, use the tools, export the audit log (if the licence allows it), and switch scheduled jobs on and off. |
| Administrator | The same, plus: users, all settings, operation mode, domain lock, support partner, diagnostics, updates, restart and stop, backup, the agent catalogue and modules, accepting host keys, and all deletion. |
| Owner | Everything. Only an Owner can give or remove the Owner role, set a password for an Owner, delete an Owner, and change who may export private keys (Security). |
Whoever claims the appliance during first-time setup becomes Owner. On Users you can choose Administrator, Operator and Viewer. The last local administrator cannot be deleted or given a lower role.
System accounts
Copy link to the section “System accounts”Two accounts are marked System account in the list. The appliance manages them itself, they cannot sign in with the form, and they do not count as logins on the licence.
- Admin Local is an Owner and opens only with the 12 backup words, see Security.
- System is recorded as the actor for things the appliance does on its own.
Logins on the licence
Copy link to the section “Logins on the licence”A login is a person who can sign in to this appliance. Admin Local and System do not count.
| Licence | Logins |
|---|---|
| Free | 1 |
| Basic | 3 |
| Professional | 10 |
| Enterprise | Unlimited |
The limit is checked only when a new person gets a login. A login that already exists is never refused. The count is shown on Users, for example “3 of 10 logins”.
sslbrain Cloud counts every user and pending invitation across all the account’s appliances. Its number can therefore differ, see sslbrain Cloud.
If sign-in fails
Copy link to the section “If sign-in fails”- “You do not have access to this installation.”: the account has no role on this appliance in sslbrain Cloud. Give it access under Team.
- The Log in with sslbrain Cloud button is missing: it appears once the appliance has been activated during first-time setup.
- sslbrain Cloud cannot be reached: sign in with a local password. A Cloud user who has signed in with a password before also gets in, because the appliance keeps a copy.
- “For mange loginforsøg. Prøv igen om … sekunder.”: the form locks after 30 failed attempts. The message is in Danish. Wait and try again.
- “Your session has expired. Please log in again.”: a session lasts 120 minutes. After signing in you return to the page you were on.
- “The licence on this appliance does not allow another login.”: delete a login under Users, or upgrade the licence.
- Anything else: see When something does not work.