Users
In UTMStack v12 you manage the people who use the product on the Team page: you add users, give them roles, and deactivate them when they leave. This page covers users, the ways to add them, password rules and sign-in sessions. Roles and what each permission allows are described in Roles and Permissions.
Before you start
Open Configure > Team. The Configure menu is shown to users with the Administrator role.
The Team page needs these permissions. The Administrator role has all of them.
| Permission | Allows |
|---|---|
users.read | List and view users |
users.write | Create and update users, assign their roles, reset their two-step sign-in |
users.delete | Deactivate users |
A user who can create users and assign roles can give any role to anyone, including themselves. Give users.write and roles.write only to people you would trust with full administrator rights.
Three ways to give someone access
| Way | How the user gets a password | Best for |
|---|---|---|
| Create local user | You set it, and give it to the user | Setting up a new server; servers whose mail is not set up yet; service accounts |
| Invite user | The user sets it from a link in an invitation email | Day-to-day additions once email works |
| Single sign-on | No UTMStack password; the user signs in with their organization account | Organizations with Microsoft Entra ID, Okta, Google Workspace or Active Directory. See Single Sign-On. |
Do not invite users who will sign in through single sign-on: an invited account stays Pending invite until the user sets a password, and single sign-on refuses it until then. Let single sign-on create the account at the first sign-in instead.
The member list
The Members tab lists every user of your organization (your tenant), 20 per page. Search by name or email. The columns are:
| Column | Shows |
|---|---|
| User | Name and email. An SSO badge marks accounts created by an identity provider. |
| Roles | The roles the user holds, or "none" |
| 2FA | On if the user has turned on two-step sign-in, otherwise Off |
| Status | See below |
| Status | Meaning |
|---|---|
| Active | The user can sign in. |
| Pending invite | The user was invited and has not set a password yet. They cannot sign in. |
| Inactive | The account was deactivated and cannot sign in. |
| Suspended | The account is suspended and cannot sign in. |
Create a local user
- 1
Open the dialog
Go to Configure > Team, open the Members tab and click Invite user. Choose Create local user ("The account is created with a password and activated immediately. No email is sent.").
- 2
Fill in the fields
Field What to enter Email The address the user signs in with ("This is the address they sign in with.") Name The user's name Password A password that follows the rules below. The dialog ticks each rule as you type. Roles One or more roles - 3
Create the user
Click Create user. You see "Local user created". Give the user their email address and password through a safe channel, and ask them to change the password from their Profile.
Invite a user by email
Invitations need a working mail server and a correct Base URL in Email Configuration. Click Send test there before you invite anyone.
- 1
Send the invitation
Go to Configure > Team, click Invite user and keep the Invite user mode ("The account is created inactive. The user receives an email to set their password and activate it."). Enter the Email, the Name and the Roles, and click Send invite.
- 2
The user opens the link
The user receives an email with a link that is valid for 7 days. The link has this form:
https://siem.example.com/reset/finish?key=... - 3
The user sets a password
In UTMStack v12.0.2, that link opens the plain sign-in page instead of the password form. To reach the form, the user changes
/reset/finishin the link to/auth/login, keeping everything from?key=on:https://siem.example.com/auth/login?key=...The page then shows the form to set a password. After that, the account is Active and the user can sign in.
Things to know about invitations:
"Invitation sent" appears even if the email could not be sent, for example because mail is not configured or the Base URL is empty. Check with the user that the email arrived.
There is no button to send an invitation again, and the same email address cannot be added twice. If an invitation is lost or expires, the account stays Pending invite. Prevent this by testing mail first, or use Create local user.
A Pending invite account cannot be reactivated from the Team page; the user has to finish setting their password first.
On a multi-tenant server, the user signs in on their tenant's own address after setting the password. See Multi-Tenancy Overview.
Password rules
| When | Rules |
|---|---|
| An administrator creates a local user | At least 8 characters, with at least one uppercase letter, one lowercase letter, and one special character (punctuation or symbol). Digits are allowed. Spaces and other characters that are not letters, digits, punctuation or symbols are refused ("password contains invalid characters"). |
| A user changes their password, or sets it from an invitation or reset link | At least 8 characters. When changing it from Profile, the new password must be different from the current one. |
Passwords are stored as one-way hashes; nobody can read them back, not even an administrator.
Forgotten passwords
Users with a local password can reset it themselves:
On the sign-in page, click Forgot?, enter the email address and click Send reset link. The page always answers "If that email is registered, a reset link is on its way."
The email contains a link that is valid for 1 hour, in the same form as the invitation link. In v12.0.2, change
/reset/finishto/auth/loginin the link, as described above.After setting the new password, all the user's existing sessions are signed out.
Only active accounts with a local password get a reset email. Accounts created by single sign-on, pending invitations and deactivated accounts get nothing. Administrators cannot set a new password for another user; if a user cannot reset their own, sign in as an administrator and help them through Forgot?.
Change a user's roles
On the Members tab, click the user to open their details.
Under Roles ("Roles grant module permissions. A user can hold more than one."), select or clear roles. Their permissions are the sum of all their roles.
Click Save roles. You see "Roles updated".
A user with no role sees "No role assigned — the user will have no module access." and can use no module.
When you change roles here, only a user who already holds the Administrator role can give the Administrator role.
Role changes reach the user's open sessions within one hour, when their sign-in renews. To apply a change at once, ask the user to sign out and sign in again.
The user's details
Clicking a user opens a panel with:
Profile: name, email and language. "Only the user can edit these — from their own profile."
Account: the status, two-step sign-in (Enabled or Not configured, with Reset), "Signs in through an identity provider." for SSO accounts, and when the account was last changed.
Roles: the role picker and Save roles.
Deactivate or Reactivate.
Reset a user's two-step sign-in
If a user loses access to their authenticator app:
Open the user's details on the Members tab.
Next to 2FA, click Reset, then confirm with Reset 2FA.
The user can then sign in with their password alone and set up two-step sign-in again from their Profile. See Profile and Two-Step Sign-In.
Deactivate or reactivate a user
UTMStack never deletes user accounts; you deactivate them instead. Their past actions stay in the audit log under their name.
Open the user's details on the Members tab.
Click Deactivate. To let the user back in later, open their details again and click Reactivate.
When you deactivate a user:
They cannot sign in, and their sessions can no longer be renewed. A page that is already open stops working within one hour.
Their API keys stop working at once.
Sessions
| Item | Value |
|---|---|
| How long a sign-in lasts before it renews | 1 hour; the browser renews it on its own |
| How long a user stays signed in without signing in again | Up to 30 days of inactivity for password and LDAP sign-ins. Single sign-on through OpenID Connect or SAML lasts 1 hour, then goes through the identity provider again. |
| Sessions per user | At most 10. A new sign-in ends the oldest. |
Users see and end their own sessions in Profile. See Profile and Two-Step Sign-In.
Messages and what they mean
| Message | Cause | Fix |
|---|---|---|
| "That email is already in use" | An account with this email already exists in this tenant, perhaps deactivated | Search for it, including deactivated users, and reactivate it instead. |
| "You do not have permission to do that" | Your roles lack the permission, or you tried to give the Administrator role without holding it | Ask an administrator. |
| "operation failed" when creating a user | The email is longer than 254 characters, or another unexpected problem | Use a shorter address; otherwise check docker service logs utmstack_backend. |
| "Invalid credentials." at sign-in for an invited user | The invitation was not completed, so the account has no password yet | Complete the invitation (see above). |
| "This account is deactivated." | The account is inactive | Reactivate it. |
| "Too many attempts. Try again in a few minutes." | Too many failed sign-ins in a short time | Wait a few minutes and try again. |
Users and tenants
On a multi-tenant licence, users belong to one tenant and sign in on that tenant's address. The same email address can exist in several tenants as separate accounts. Each tenant administrator manages their own tenant's users on their own Team page. See Multi-Tenancy Overview.