Users
This page explains who can use the MicroB2B web UI and how you manage those users. You can manage users in the web UI and on the command line with microb2b users.
Every user is an administrator
MicroB2B has no roles or permissions. Everybody who signs in can do everything. Only give an account to people you trust with your whole B2B setup.
What a user has
A user has:
- A name. It is 1 to 64 characters: lower case letters, digits,
.,_,-and@. It starts with a letter or digit and cannot be changed. - A display name. MicroB2B shows it in the page header.
- Password login, on or off. With it on, the user signs in with a password and a code from an authenticator app.
- An identity at an identity provider, for a user who signs in with single sign-on. See identity providers.
Users you create yourself have password login on. Users that an identity provider creates at their first sign-in have it off.
Every way of signing in ends with one of these user records. So Access > Users lists everybody who ever signed in. You disable a user or sign them out the same way, however they sign in. The audit log names every person by their user name.
There is no default user
MicroB2B has no default user and no default password. You create the first user on the command line. Required settings shows how.
Creating a user
- Go to Access > Users and click New user.
- Enter a name and, if you like, a display name.
- Click Create user.
- MicroB2B shows a setup link once. Copy it and give it to the user.
On the command line:
microb2b users create jane --display-name "Jane Smith"The setup link works once and for 24 hours. On the setup page the user chooses a password and sets up an authenticator app. MicroB2B sends no e-mail, so you hand over the link yourself. Treat it like a password until it is used.
If you lose a link or it expires, reset the user (see below). That gives a new link and the old one stops working.
The user list
Access > Users shows each user with a status:
| Status | Meaning |
|---|---|
| Active | The user can sign in. |
| Setup pending | The user has a setup link and has not finished setup yet. |
| Needs a setup link | Password login is on, but the user has no password or authenticator and no open link. Reset the user. |
| No sign-in | Password login is off and the user has no identity at a provider. |
| Disabled | The user cannot sign in in any way. |
The Sign-in column shows whether the user signs in with a password, at an identity provider, or both.
Managing a user in the web UI
Open the user from Access > Users. The page shows their details and, under Credentials and sessions, these buttons:
| Button | What it does |
|---|---|
| Reset password | Removes the password and gives a new setup link. The authenticator stays. |
| Reset authenticator | Removes the authenticator app and the recovery codes and gives a new setup link. The password stays. |
| Reset both | Removes both and gives a new setup link. |
| Turn password login off | Stops sign-in with a password. The user’s sessions end. |
| Turn password login on | Lets a user sign in with a password. Gives a setup link when they need one. |
| Sign out everywhere | Ends every session of the user. |
| Disable / Enable | Stops or allows every way of signing in. Disabling ends the user’s sessions. |
The reset buttons appear only while password login is on. You change the display name in the Details section and click Save. To delete a user, use the danger zone at the bottom of the page.
A reset also ends the user’s sessions. When a reset keeps one credential, the setup page asks for it first. After a password reset, the user enters a code from their authenticator app. After an authenticator reset, they enter their password. So a stolen setup link alone is not enough to take over the account.
Managing users on the command line
microb2b users works without a running MicroB2B and without a web session. It opens the database itself, so it needs the same DB_TYPE and DB_URL as MicroB2B. It does not need SECRETS_KEY. Set PUBLIC_URL to get whole setup links; otherwise it prints only the path.
| Command | What it does |
|---|---|
microb2b users create <name> [--display-name <text>] | Creates a user with password login on and prints the setup link. |
microb2b users list | Lists users: name, display name, enabled, password set, authenticator set, open setup link, last sign-in. |
microb2b users reset-password <name> | Removes the password and prints a new setup link. |
microb2b users reset-totp <name> | Removes the authenticator app and recovery codes and prints a new setup link. |
microb2b users reset <name> | Removes both and prints a new setup link. |
microb2b users password-login <name> on|off [--force] | Turns password login on (with a setup link when needed) or off. |
microb2b users disable <name> [--force] | Stops the user from signing in in any way. |
microb2b users enable <name> | Lets the user sign in again. |
microb2b users delete <name> [--yes] [--force] | Deletes the user. Asks for confirmation unless you give --yes. |
microb2b users sign-out <name> | Ends every session of the user. |
A reset is refused while password login is off. Turn password login on instead.
The last user who can sign in
MicroB2B protects you from locking everybody out. It refuses these changes for the last user who can still sign in:
- disabling the user,
- deleting the user,
- turning password login off.
On the command line you can override this with --force. In the web UI, create and set up another user first.
Your own account
Click your name in the page header to open Your account. With password login on, you can:
- Change password. You enter your current password and a new one.
- Replace the authenticator. You enter your password and a code from the new app, then click Use this authenticator. You get new recovery codes.
- Get new recovery codes. You enter your password. The old codes stop working.
Changing your password or authenticator ends your other sessions. Your current session continues.
If you sign in at an identity provider, the page says so. You manage your password there.
Passwords and single sign-on together
Each user can have a password, an identity provider, or both. A common setup is:
- Everyday users sign in at the identity provider.
- One administrator keeps password login on as a break-glass account. You use it when the provider is down or misconfigured.
Keep the break-glass password and recovery codes somewhere safe and offline. See account recovery.
You can give a user of an identity provider password login too. Open the user and click Turn password login on, then hand over the setup link. You cannot link an existing password user to an identity provider. The provider creates its own user at the first sign-in.
What is recorded
Creating, changing and deleting users are events in the audit log. Credential changes are recorded without their values. A command-line change names the actor cli:<operating system user>. A user that an identity provider creates is recorded with the actor system.
Sign-ins and failed sign-ins are log lines, not audit events.