Language of the user interface.
User Profile
User profile, password and security settings.
Overview
Section titled “Overview”Account settings that every signed-in user manages for their own account: language, password, two-factor authentication, personal audit log and sessions.
Change the account password.
Protect the login with an authenticator app (TOTP) and recovery codes.
History of the logins and actions of your account.
Browser sessions currently signed in with your account.
Access
Section titled “Access”Click your avatar in the top right corner of the application to open the profile menu. It contains:
| Entry | Description |
|---|---|
| Dark / Light | Switches the theme between light and dark. The choice is remembered in the browser, so it can differ from one browser to another. |
| Profile | Opens the pages described below. |
| Admin Area | Opens the Admin Area. |
| Sign Out | Ends the session. |
Preferences
Section titled “Preferences”Language sets the language of the user interface for your account, and of the account emails sent to you (email confirmation, password reset, two-factor authentication turned off). Select it and click Save changes: the page reloads in the new language.
English is currently the only language available.
Password
Section titled “Password”Enter the Old Password, the New Password and repeat it in Confirm Password, then click Update password. After the confirmation the page reloads and you stay signed in. Every other browser signed in with your account is signed out at once. The same happens when the password is set from a reset link. After a reset from the command line they are signed out within two minutes.
The other browsers are also signed out at once when the 2FA setup is completed or closed, and when 2FA is turned off with Disable 2FA.
A sign-in survives a restart or an update of the application: you do not have to sign in again.
The new password must satisfy the password policy of the installation. By default: at least 6 characters, with at least one digit, one lowercase letter, one uppercase letter and one special character. An administrator can change the policy in appsettings.extra.json.
Forgotten password: If you cannot log in, use Forgot password? on the login page to receive a reset link by email. This requires the SMTP server to be configured in General Settings. At most 3 links are sent to the same address in 15 minutes, and 10 requests are accepted from the same computer: beyond that the page shows the same confirmation and no message is sent. As an alternative, ask an administrator to reset the password with the CLI.
Email confirmation
Section titled “Email confirmation”An account can sign in only after its email address is confirmed with the link received by email. When the link no longer works, the confirmation page shows Request a new confirmation link; the login page has Resend email confirmation. Both open a page that asks for the email: a new link is sent only when the account exists and its email is not confirmed yet. At most 3 requests are accepted for the same email in 15 minutes, and 10 from the same computer: beyond that no message is sent. The page shows the same confirmation in every case.
Two-factor authentication (2FA)EE
Section titled “Two-factor authentication (2FA)”Adds a second step to the login: a 6-digit code generated by an authenticator app (TOTP).
The page shows the current state: 2FA is not enabled or 2FA is active.
Enable 2FA
Section titled “Enable 2FA”- Click Enable 2FA.
- Scan the QR code with your authenticator app, or type the Manual entry key shown under it.
- Enter the 6-digit code generated by the app and click Verify & Enable 2FA.
- Ten recovery codes are shown. Save them in a safe place: use Download Codes to get them as a text file, then click I’ve Saved the Codes.
Recovery codes are meant for the case where the authenticator device is not available. Each code can be used only once.
Logging in with 2FA
Section titled “Logging in with 2FA”After user name and password, the login asks for the authenticator code. A wrong code can be typed again on the same page, until the account is locked for too many failed attempts.
The code is asked also after a sign-in with a domain or with an identity provider of External Authentication.
If the authenticator device is not available, click log in with a recovery code on the same page and enter one of the saved recovery codes. The code is consumed: it cannot be used a second time.
Remember Machine skips the code on that browser for the following logins. The browser is remembered for the number of days set in CookieSettings:ExpireDays (default 30), then the login asks for the code again. The 2FA page shows a remembered browser as This browser is remembered for 30 days, with the number of days in use. Its Forget button makes the login ask for the code again at once.
Managing 2FA
Section titled “Managing 2FA”| Action | Description |
|---|---|
| Generate Recovery Codes | Creates ten new recovery codes and shows them once, with Download Codes. All the previous codes stop working immediately. |
| Reset Authenticator | Turns 2FA off and starts the setup again with a new QR code: the current entry in your authenticator app stops working. Use it to move 2FA to another device. |
| Disable 2FA | Turns 2FA off. Requires the 6-digit code from the authenticator app or one of the recovery codes, plus a confirmation. |
| Forget | Removes the “remembered browser” state of the current browser. |
Disable 2FA sends you an email, so a change you did not make does not go unnoticed. Reset Authenticator sends no email: it is recorded in your Audit Logs.
Lost device and recovery codes: ask an administrator to use Disable 2FA in Security, or use the CLI on the server. A password reset does not turn 2FA off.
When three or fewer recovery codes are left, the page shows a warning with a Generate new codes button.
Audit LogsEE
Section titled “Audit Logs”The audit log filtered on your account: logins and the actions you performed. It has the same columns and details as the administrator’s Audit Logs.
Active Sessions
Section titled “Active Sessions”Lists the browser sessions currently connected with your account: UserName, Login, Ip Address, Device, Platform, Browser, Current Page and Last Activity. Use it to check that every session is one of yours.
EE Select one or more sessions and use Force logout to terminate them, or Send Message to send them a notification.
In the Community Edition the list is read-only.
