Users and sign-in
Copy link to the page “Users and sign-in”Sign in to the appliance and give colleagues access with the right role.
What you need
Copy link to the section “What you need”- An account in sslbrain Cloud (EU) with access to the appliance.
- An administrator login if you need to create a local user.
Sign in with sslbrain Cloud
Copy link to the section “Sign in with sslbrain Cloud”-
Click Log in with sslbrain Cloud on the sign-in page.
-
Sign in to sslbrain Cloud with a password, GitHub, Google or Microsoft. If two-factor authentication is enabled, enter a code from your authenticator app (TOTP) or a recovery code.
-
Wait until you return to the appliance. Your role is fetched from sslbrain Cloud.
This two-factor authentication applies to sslbrain Cloud sign-in. Local passwords and AD sign-in on the appliance do not use Cloud two-factor authentication. Each user enables it individually; organisations cannot require it for all users.
Check that it works
Copy link to the section “Check that it works”After signing in, you are back on the appliance. The user menu shows your name and role.
If it fails
Copy link to the section “If it fails”- “You do not have access to this installation.”: the account has no role on this appliance in sslbrain Cloud. Give it access under Team.
- “Your role in sslbrain Cloud is Operator or Viewer, and the licence on this appliance gives only Owner and Administrator. Ask an Owner to give you another role in sslbrain Cloud under Team, and try again.”: a new person with the Operator or Viewer role cannot sign in when the licence does not include that role. An Owner must change the role in sslbrain Cloud under Team.
- The Log in with sslbrain Cloud button is missing: it appears once the appliance has been activated during first-time setup.
- sslbrain Cloud cannot be reached: sign in with a local password. A Cloud user who has signed in with a password before also gets in, because the appliance keeps a copy.
- Too many sign-in attempts → the form locks after 30 failed attempts. Wait the number of seconds shown and try again.
- “Your session has expired. Please log in again.”: a session lasts 120 minutes. After signing in you return to the page you were on.
- “The licence on this appliance does not allow another login.”: delete a login under Users, or upgrade the licence.
- Anything else: see When something does not work.
The role is fetched from sslbrain Cloud at every Cloud sign-in:
| In sslbrain Cloud | Role on the appliance |
|---|---|
| Owner of the account | Owner |
| Member of this particular appliance | The role the member has in Cloud |
| Administrator on the account | Administrator |
| Anyone else, including the Billing role | No access |
Change a Cloud user’s role in sslbrain Cloud under Team, see sslbrain Cloud. A role changed under Users is reset at the user’s next Cloud sign-in.
Every sign-in, sign-out and failed sign-in is written to the audit log.
Create a user on the appliance
Copy link to the section “Create a user on the appliance”If a colleague should sign in with their sslbrain Cloud account, invite them in sslbrain Cloud under Team. If they only need a login on the appliance, create a local user:
-
Open Appliance › Users and login › Users and click Add user.
-
Fill in username, email, password and role. The password must be at least 10 characters. Email is required, even though the field is labelled Email (optional).
-
Click Create user. Confirm your own sign-in if the appliance asks.
The user signs in with email and password.
Local password
Copy link to the section “Local password”With a local password, a user signs in without the appliance asking sslbrain Cloud. Give at least one user a local password, so there is a way in when sslbrain Cloud cannot be reached.
-
Open the user menu at the top and choose Local password.
-
Type the new password twice. It must be between 10 and 200 characters. If the account already has a local password, type the current one as well.
-
Click Save password.
The account is then a local account on this appliance. The Log in with sslbrain Cloud button still works for it.
An administrator can set another user’s password with Edit under Users, after confirming their own sign-in. If Admin Local sets the password, it cannot be used to confirm that user’s sign-in afterwards, see Admin Local.
Each role can do everything the role above it in the table can. The role names are in English on the appliance and in sslbrain Cloud.
| Role | Can |
|---|---|
| Viewer | View the overview, certificates, servers, the audit log, the settings pages (without changing them) and Support. |
| Operator | The same, plus: create and edit servers, credentials, profiles and certificates (including upload), create and run installation plans, rerun deployments, create alert channels and alert rules, edit sources, run discovery and TLS scanning, use the tools, export the audit log (if the licence allows it), and switch scheduled jobs on and off. |
| Administrator | The same, plus: users, all settings, operation mode, domain lock, support partner, diagnostics, updates, restart and stop, backup, the integration catalogue and modules, accepting host keys, and all deletion. |
| Owner | Everything. Only an Owner can give or remove the Owner role, set a password for an Owner, delete an Owner, and change who may export private keys (Security). |
Whoever claims the appliance during first-time setup becomes Owner. Free includes Owner and one login. Basic includes Owner and Administrator. Professional and Enterprise include all four roles. A user who already has Operator or Viewer keeps the role. On Users, the role list only shows roles included in the licence. The last local administrator cannot be deleted or given a lower role.
If a role is refused, the appliance shows: “Operator and Viewer come with Professional. Give the user the Administrator role, or upgrade the licence.”
System accounts
Copy link to the section “System accounts”Two accounts are marked System account in the list. The appliance manages them itself, they cannot sign in with the form, and they do not count as logins on the licence.
- Admin Local is an Owner and opens only with the 12 backup words, see Security.
- System is recorded as the actor for things the appliance does on its own.
Logins on the licence
Copy link to the section “Logins on the licence”A login is a person who can sign in to this appliance. Admin Local and System do not count.
| Licence | Logins |
|---|---|
| Free | 1 |
| Basic | 3 |
| Professional | 10 |
| Enterprise | No licence limit |
The limit is checked only when a new person gets a login. A login that already exists is never refused. The count is shown on Users, for example “3 of 10 logins”.
In sslbrain Cloud, the count includes every user and pending invitation across all the account’s appliances. Its number can therefore differ, see sslbrain Cloud.