Users, profile, password and two-factor login
Create a login for every person, change your own password and language, and protect logins with an authenticator app.
→ Overview
The Configurator has local user accounts. Each person who works on the controller should have their own login, so that the Audit log shows who changed what.
- Settings → Users lists all users. Here you create, edit and delete users and switch two-factor login off for a user.
- Settings → Profile → Personal information changes your own name, password and language.
- Settings → Profile → Logout ends your session.
There are no roles or permission levels. Every user created here is an administrator and can change all settings: network, users, update, restore and factory reset. Create users only for people who need that access.
1 Add a user
Users list
| Column / button | What it does |
|---|---|
| Name, Lastname, Username | User details. Your own row is shown in bold. |
| 2FA | Green tick: two-factor login is on. Click it to switch it off for that user, after confirming. Grey cross: two-factor login is off. On your own row, click it to set up two-factor login; on other rows it only shows "You can only enable two-factor authentication for your own account." |
| Actions | Edit icon: opens Edit user. Bin icon: deletes the user after the question "Are you sure you want to delete it?". There is no bin icon on your own row. |
| New user | Opens the New user form. |
New user and Edit user
| Field | What it does | Rules / default |
|---|---|---|
| Name | First name of the user. | Required |
| Lastname | Last name. | Optional |
| Username | Login name. On Edit user it cannot be changed. | Required · unique ("Username exists") |
| Password | Login password. On Edit user, leave it empty to keep the current password. | Required for a new user · no length or complexity rule |
| Repeat password | Must match Password, otherwise "Passwords do not match" is shown. | — |
| Language | Language of the Configurator for this user: Bulgarian, Croatian, Czech, Dutch, English, Finnish, French, German, Italian, Polish, Portuguese, Romanian, Serbian, Slovak, Slovenian, Spanish or Swedish. | English |
| Back | Returns to the list without saving. | — |
| Save | Saves the user. The change is recorded in the Audit log. | — |
The controller accepts any non-empty password. Choose a long one, especially if the controller can be reached over the internet or a VPN.
Deleting a user cannot be undone; the person can no longer log in. You cannot delete your own account. If all administrator accounts are ever gone, the controller creates the default admin user again with its factory password at the next restart.
2 Change your own password or language
| Field | What it does | Rules |
|---|---|---|
| Name, Lastname | Your name. | Name required |
| Username | Your login name. Read-only. | — |
| Password, Repeat password | New password. Empty = keep the current one. | Must match |
| Language | Language of the Configurator for your account. | — |
| Back, Save | Leave without saving / save the changes. | — |
Every controller starts with the user admin and a factory password. Change that password when you commission the controller, and store the new one safely.
Change password page
A separate page with only New password, Repeat password, Back and Save exists at #/user/change-password. It has no menu entry. Use Personal information instead.
3 Two-factor login (2FA)
With two-factor login, the Configurator asks for a 6-digit code from an authenticator app (for example Google Authenticator or Microsoft Authenticator) after the password. The code changes every 30 seconds. You can set up 2FA only for your own account.
Anyone who has them can generate valid codes for your account. Do not take a photo or screenshot of the dialog, and do not send the key to anyone. (They are blurred in the picture above.) If you think the key was seen by someone else, switch 2FA off and set it up again: a new key is created each time.
At login, after the password, the Two-step verification screen asks for the Verification code. Type the 6-digit code from the app and click Verify.
- If you lose the phone with the authenticator app, you cannot log in. Another user can switch off your 2FA by clicking the green tick on your row. Keep at least two users on every controller, and do not rely on one phone for all of them.
- The code depends on the controller's clock. If the controller time is wrong by more than about 30 seconds, valid codes are rejected. Check Settings → System → Time before you set up 2FA.
- The QR code and the text key give access to the account. Do not photograph them or send them to anyone.
Click the green tick in the 2FA column of a user and confirm Are you sure you want to disable two-factor authentication for this user?. Any user can do this for any user, including themselves. The change is recorded in the Audit log.
4 Login and session rules
| Situation | What happens |
|---|---|
| Wrong username or password | "Invalid credentials". The message does not say which one is wrong. |
| 10 failed logins for one username within 60 seconds | "Too many attempts. Please try again later." Wait one minute. The account is not locked. |
| Wrong 2FA code | "Invalid code". After 10 wrong codes within 60 seconds, "Too many attempts. Please try again later." |
| No activity for 8 hours | The session ends and you have to log in again. Each action renews the 8 hours. |
| Logout | Settings → Profile → Logout ends the session at once. |
5 Checklist
- The default admin password has been changed.
- Every person has their own user; no shared logins.
- At least two users exist, so one can help if the other is locked out.
- 2FA is enabled for users who log in remotely, and the controller time is correct.
- Users who no longer need access have been deleted.