.. /* * This file is part of the SavaPage project . * Copyright (c) 2026 Datraverse B.V. * Author: Rijk Ravestein. * * SPDX-FileCopyrightText: (c) 2020 Datraverse B.V. * SPDX-License-Identifier: CC-BY-SA-4.0 * * For more information, please contact Datraverse B.V. at this * address: info@datraverse.com */ .. _ch-webapp-admin-users: Users ----- .. contents:: |RST_TABLE_OF_CONTENTS| :depth: 2 :local: .. _ch-webapp-admin-user-list: User List ~~~~~~~~~ After a *tap* on the |RST_BUTTON_USERS| button in the main menu this panel is shown. See :ref:`Menu `. .. _ss-admin-user-list: .. figure:: ../images/manual/screenshots/admin/sp-01-02-user-list.png :alt: Admin Web App: User - List :width: 400 Admin Web App: User - List - All non-deleted users are listed alphabetically by default. A different selection and sorting can be entered: see :ref:`Admin Web App: User - Select and Sort `. - Press the |RST_BUTTON_NEW| button to :ref:`create ` and edit a new :ref:`Internal User `. Note: the button is *not* visible if :ref:`System Status ` says |RST_GUILABEL_SETUP_IS_NEEDED|. - The list can be traversed by tapping one of the buttons at the *pager* at the top or bottom of the page. - An entry is displayed for each user, with identifying data and some usage statistics. From top to bottom: - The user's role or status (at the top right corner). - An inline pagometer Pie-Chart followed by the user id. The *blue* color in the chart represents the number of pages printed to |PRODUCT_NAME|. The *green* color represents the number of pages exported to PDF. The *red* color depicts the pages printed to Proxy Printers. - The user id of an :ref:`Internal User ` is shown with an *orange* color. - The full name and email address. A key icon is shown if a :ref:`PGP Public Key ID ` is present. See :ref:`User List Item `. - If applicable, the :ref:`User Name Aliases ` the user is known by. - The period in which user activity was accumulated on the pagometer. - The account balance and the pagometer including the number of jobs and bytes printed to any |PRODUCT_NAME| :ref:`Queue `. - The size of the user's SafePages home. More user details are discussed in :ref:`User List Item `. - Tap the |RST_BUTTON_EDIT| button to change or delete the user. See :ref:`Edit User `. .. note:: :ref:`Deleted Users ` cannot be edited. - The |RST_BUTTON_DOCUMENTS| button brings you to the list of documents the user processed. See :ref:`Admin Web App: Document - List `. - The |RST_BUTTON_TRANSACTIONS| button brings you to the list of financial transactions on the user's account. For a detailed description of this list see :ref:`Transactions ` in the User Web App chapter. - The rightmost |RST_BUTTON_GDPR| button opens a pop-up where personal user data can be downloaded. See :ref:`Download Personal Data `. .. note:: Buttons are *not* visible if :ref:`System Status ` says |RST_GUILABEL_SETUP_IS_NEEDED|. If setup is *not* needed, certain buttons might *not* be visible due to :ref:`Admin Privileges `. .. tip:: The pagometers of all users can be reset at :ref:`Options > Advanced > Reset Pagometers `. .. _ss-admin-user-select-sort: .. figure:: ../images/manual/screenshots/admin/sp-01-02-user-select-sort.png :alt: Admin Web App: User - Select and Sort :width: 400 Admin Web App: User - Select and Sort - Users can be selected by :ref:`Group ` and by entering a part (fragment) of their (display) |RST_GUILABEL_NAME| or |RST_GUILABEL_EMAIL|. So entering "son" as ID will select both "jason" and "sonja". - Select the |RST_GUILABEL_TYPE|, |RST_GUILABEL_ROLE| and (|RST_GUILABEL_DELETED|) |RST_GUILABEL_STATUS|. The |RST_BUTTON_MINUS_SYMBOL| button will select both option values. - If :ref:`Self Registration ` is enabled, Registration Requests can be selected. The status of the verification (Pending or Expired) is shown in the User List. See :ref:`Registration Requests `. .. figure:: ../images/manual/screenshots/admin/sp-01-02-user-select-sort-registration-requests.png :alt: Admin Web App: User - Select Registration Requests :width: 400 Admin Web App: User - Select Registration Requests - The list can be sorted |RST_BUTTON_ASCENDING| or |RST_BUTTON_DESCENDING| by Name ID or Email. - *Tap* the |RST_BUTTON_APPLY| button to (re)display the list. - A *tap* on the |RST_BUTTON_DEFAULT| button resets the selection and sort fields to their default values. - The PDF and CSV buttons downloads the User List in their respective formats, using the selection item values. - The minus icon collapses the Select and Sort section. .. _ch-webapp-admin-user-list-item: User List Item ^^^^^^^^^^^^^^ Each Users List Item displays the resolved number of enabled and disabled :ref:`User Roles `, :ref:`Group Roles `, :ref:`User Privileges ` and :ref:`Admin Privileges ` objects with their respective icon. User Roles are displayed next to the User ID. Objects that are resolved by User Group membership are shown below. A green color means that the objects are enabled, a red color means they are disabled. A description of the objects is displayed as a tooltip when pointed to with the mouse. An example item is shown below. .. figure:: ../images/manual/screenshots/admin/sp-01-02-user-list-item.png :alt: Admin Web App: User - List Item :width: 400 Admin Web App: User - List Item .. figure:: ../images/manual/screenshots/admin/sp-01-02-user-list-item-pgp-key.png :alt: Admin Web App: User - List Item - PGP Key :width: 400 Admin Web App: User - List Item - PGP Key A key icon is shown at the email address if a :ref:`PGP Public Key ID ` is present. .. _ss-webapp-admin-user-list-item-papercut-balance: If :ref:`PaperCut Personal User Account ` is enabled, the account balance of both PaperCut and SavaPage is displayed with their respective icons, as shown in the screenshot below: .. figure:: ../images/manual/screenshots/admin/sp-01-02-user-list-item-papercut-account-balance.png :alt: Admin Web App: User - PaperCut Account Balance :width: 400 Admin Web App: User - PaperCut Account Balance .. _ch-webapp-admin-user-data-portability: Download Personal Data ~~~~~~~~~~~~~~~~~~~~~~ This pop-up opens when the rightmost |RST_BUTTON_GDPR| button is pressed in an entry from the :ref:`User List `. .. figure:: ../images/manual/screenshots/admin/sp-01-02-user-list-gdpr-popup.png :alt: Admin Web App: User Data Portability :width: 400 Admin Web App: User Data Portability See :ref:`Data Portability `. .. _ch-webapp-admin-user-list-data-erasure: Erased Users ~~~~~~~~~~~~ Erased Users have their personal data cleared. Since their ID is empty, an “anonymous” placeholder with date/time of erasure is used for display. .. figure:: ../images/manual/screenshots/admin/sp-01-02-user-list-gdpr-erased-user.png :alt: Admin Web App: Erased User :width: 400 Admin Web App: Erased User See :ref:`Data Erasure `. .. _ch-webapp-admin-user-list-self-registration-requests: Registration Requests ~~~~~~~~~~~~~~~~~~~~~ :ref:`Self Registration ` Requests for users that have not yet been verified are identied with **Pending** or **Expired**. Requests can be selected in the :ref:`Select and Sort ` section. .. _ch-webapp-admin-user-edit: Edit User ~~~~~~~~~ This chapter describes the editable sections of the User entity. .. caution:: Some data you edit, like the |RST_GUILABEL_NAME|, |RST_GUILABEL_PRIMARY_EMAIL|, |RST_GUILABEL_CARD_NUMBER| and |RST_GUILABEL_ID_NUMBER| might be overwritten by values from the user source during synchronization. See :ref:`LDAP ` and :ref:`User Creation `. .. note:: Users can also be edited and deleted with the Server Command Tool. See :ref:`setUserProperties ` and :ref:`deleteUser `. .. _ch-webapp-admin-user-edit-identity: Identity ^^^^^^^^ .. _ss-admin-user-edit-external-identity: .. figure:: ../images/manual/screenshots/admin/sp-01-02-user-edit-external-name.png :alt: Admin Web App: Edit External User - Identity :width: 400 Admin Web App: Edit External User - Identity - The user's full |RST_GUILABEL_NAME| can be edited. Remember this name can be overwritten for an *external* User as a result of user synchronisation. See :ref:`User Creation `. - Assign the :ref:`Administrator ` role by ticking the checkbox. - Users are regarded as :ref:`Person ` by default. Un-tick the |RST_CHECKBOX_PERSON| checkbox if this user represents a generic :ref:`functional account `. This will make the user :ref:`Abstract `. - Tick the |RST_CHECKBOX_DISABLED| checkbox to deny the user access to the SavaPage application. .. warning:: When a User becomes :ref:`Abstract ` its SafePages are removed. .. _ch-webapp-admin-user-edit-roles: User Roles ^^^^^^^^^^ .. figure:: ../images/manual/screenshots/admin/sp-01-02-user-edit-roles.png :alt: Admin Web App: Edit User - Roles :width: 400 Admin Web App: Edit User - Roles User Roles are needed to access certain application objects, as shown in the table below. .. table:: User Roles +-------------------+-------------------------------------------------------------------------+ | Role | Access | +===================+=========================================================================+ | Job Ticket | :ref:`Job Ticket Printer ` | | Creator | | +-------------------+-------------------------------------------------------------------------+ | Job Ticket | :ref:`Job Tickets Web App ` | | Operator | | +-------------------+-------------------------------------------------------------------------+ | Mail Ticket | :ref:`Mail Tickets Web App ` | | Operator | | +-------------------+-------------------------------------------------------------------------+ | Web Cashier | :ref:`Point-of-Sale Web App ` | +-------------------+-------------------------------------------------------------------------+ | Print Job Creator | A :ref:`Proxy Printer ` | | | that is *not* a | | | :ref:`Job Ticket Printer` | +-------------------+-------------------------------------------------------------------------+ | Print Job | |RST_LINK_DELEGATEDPRINT| and Users and Groups with role | | Delegate | | | | “Print Job Delegator” for |DELEGATEDPRINT|. | +-------------------+-------------------------------------------------------------------------+ | Print Job | This is a passive role. Delegators can be accessed | | Delegator | | | | by users with role “Print Job Delegate”. | +-------------------+-------------------------------------------------------------------------+ | Print Site | :ref:`Print Site Web App ` | | Operator | | +-------------------+-------------------------------------------------------------------------+ Each role is set with a checkbox that has three states: - *Checked* : The role is *enabled*. - *Unchecked* : The role is *disabled*. - *Unchecked and grayed out*: The role is *indeterminate*. If a User Role is needed to access an application function, |PRODUCT_NAME| will check if this role is *enabled* for the authenticated user. When the role is *indeterminate* at the user level, :ref:`Group Roles ` are checked of the groups the user belongs to. :ref:`Added Groups ` are checked first, then the :ref:`Built-in Groups `, with the “All Users” group as last. - Access is *granted* if there is at least one group where the role is *enabled*. - Access is *denied* when the role is *indeterminate* or *disabled* in all groups. - Print Job Creator role is special: an *indeterminate* state at “All User” top level is interpreted as *granted*. .. note:: A summary of enabled/disabled roles is displayed in the :ref:`User List Item `. .. caution:: The 3-tier group hierarchy (*User Groups > Internal/External Users > All Users*) is traversed bottom up, to resolve the role of individual Users only. Group hierarchy is *not* used to resolve roles for User Groups: roles defined at group level are fixed, and are not interpreted in the context of other groups, or individual members. .. _ch-webapp-admin-user-edit-email: Email ^^^^^ .. _ss-admin-user-edit-email: .. figure:: ../images/manual/screenshots/admin/sp-01-02-user-edit-email.png :alt: Admin Web App: Edit User - Email :width: 400 Admin Web App: Edit User - Email - The |RST_GUILABEL_PRIMARY_EMAIL| and |RST_GUILABEL_OTHER_EMAILS| addresses are editable and must each be *unique*: they can be associated to just one User. Multiple emails must be separated by any of the characters *space*, *comma*, *semicolon*, or by carriage return or line feed. - When saving, all email addresses are converted to *lowercase*. .. _ch-webapp-admin-user-edit-card-pin-yubikey: Card, Yubikey ^^^^^^^^^^^^^ .. _ss-admin-user-edit-card: .. figure:: ../images/manual/screenshots/admin/sp-01-02-user-edit-card-yubikey.png :alt: Admin Web App: Edit User - Card, Yubikey :width: 400 Admin Web App: Edit User - Card, Yubikey - The |RST_GUILABEL_CARD_NUMBER| must be *unique*: it can be associated to just one User. It must be entered in HEX/LSB format. See :ref:`Card Number Format `. |RST_GUILABEL_CARD_NUMBER| is used for :ref:`Web App Login `. - The |RST_GUILABEL_YUBIKEY_PUBLIC_ID| is used for YubiKey Authentication. .. _ch-webapp-admin-user-edit-id-number: ID number ^^^^^^^^^ .. figure:: ../images/manual/screenshots/admin/sp-01-02-user-edit-id-number.png :alt: Admin Web App: Edit User - ID number :width: 400 Admin Web App: Edit User - ID number |RST_GUILABEL_ID_NUMBER| must be *unique*: it can be associated to just one User. It is automatically generated when a user successfully logs in for the first time. The number can be re-generated by pushing the |RST_BUTTON_GENERATE| button. The number is used for :ref:`Web App Login ` and as authentication token for :ref:`Internet Print `. The following configuration properties apply: .. table:: Configuration Properties for User ID number +--------------------------------+-----------------------------------------------------+ | Configuration property | Description | +================================+=====================================================+ | user.id-number-length-min | The minimum length of User ID number (manual entry) | | | | | | Default: ``4``. | +--------------------------------+-----------------------------------------------------+ | user.id-number-generate.enable | Set to ``Y`` (default) or ``N`` to enable/disable | | | | | | automatic generation of User ID number. | +--------------------------------+-----------------------------------------------------+ | user.id-number-generate.length | Length of generated User ID number. Minimal | | | | | | value: ``6``. Default: ``8``. | +--------------------------------+-----------------------------------------------------+ See |RST_LINK_CONFIG_EDITOR| on how to change these values. .. _ch-webapp-admin-user-edit-uuid: UUID ^^^^ .. _ss-admin-user-edit-uuid: .. figure:: ../images/manual/screenshots/admin/sp-01-02-user-edit-uuid.png :alt: Admin Web App: Edit User - UUID :width: 400 Admin Web App: Edit User - UUID The UUID [4]_ is used as authentication token for :ref:`Internet Print ` and :ref:`RESTful Web Services `. It is automatically created when a user successfully logs in for the first time. A new UUID can be created by pushing the |RST_BUTTON_GENERATE| button. .. note:: Users can replace their own UUID. See :ref:`Internet Printer `. .. [4] A universally unique identifier (UUID) is an identifier standard used in software construction. See https://en.wikipedia.org/wiki/Universally_unique_identifier .. _ch-webapp-admin-user-edit-openpgp: OpenPGP ^^^^^^^ In this section the OpenPGP Public Key ID of the user can be entered. This key will be used to encrypt email send to the user. The |RST_BUTTON_SEARCH| and |RST_BUTTON_CHECK| buttons are shown when the OpenPGP key server URL is configured. They open a tab to the key server, where public keys can be searched and checked (verified). See :ref:`OpenPGP Settings `. .. figure:: ../images/manual/screenshots/admin/sp-01-02-user-edit-openpgp.png :alt: Admin Web App: Edit User - OpenPGP :width: 400 Admin Web App: Edit User - OpenPGP .. _ch-webapp-admin-user-edit-financial: Financial ^^^^^^^^^ This section shows the personal :ref:`User Account `. Initialization of this account is based on Group Membership as explained in the :ref:`Edit Group ` section. .. _ss-admin-user-edit-financial: .. figure:: ../images/manual/screenshots/admin/sp-01-02-user-edit-financial.png :alt: Admin Web App: Edit User - Financial :width: 400 Admin Web App: Edit User - Financial - A new value for the user's account |RST_GUILABEL_BALANCE| results in a financial transaction that corrects the previous account balance. See :ref:`Transactions `. Users are notified by a pop-up message in their active User Web App when their balance is adapted. - Set the |RST_GUILABEL_CREDIT_LIMIT| with one of these buttons: - |RST_BUTTON_NONE| : user has no credit limit, and is not restricted. - |RST_BUTTON_DEFAULT| : user has default credit limit. See :ref:`General Financial Options `. - |RST_BUTTON_INDIVIDUAL| : when selected a custom credit limit can be entered. .. _ch-webapp-admin-user-edit-pin: PIN ^^^ .. figure:: ../images/manual/screenshots/admin/sp-01-02-user-pin-actions.png :alt: Admin Web App: Internal User - PIN Actions :width: 400 Admin Web App: Internal User - PIN Actions A tap on the |RST_BUTTON_RESET| button shows the :ref:`PIN Reset Dialog `. The |RST_BUTTON_ERASE| button is shown when a |RST_LINK_CONFIG_EDITOR| is set. When pressed, it erases the |RST_LINK_CONFIG_EDITOR| and makes itself disappear again. Use this dialog to initially set or change the value. .. _ss-admin-user-pin-reset: .. figure:: ../images/manual/screenshots/admin/sp-01-02-user-pin-reset.png :alt: Admin Web App: Internal User - PIN Reset :width: 400 Admin Web App: Internal User - PIN Reset The |RST_GUILABEL_PIN| must be digits only. The minimum and maximum length of a |RST_GUILABEL_PIN| are contained in the configuration keys ``user.pin-length-min`` and ``user.pin-length-max``. A maximum value ``0`` (zero) indicates the maximum is unspecified. Use the |RST_BUTTON_EYE_SYMBOL| button on the right side of the entry fields to show/hide the PIN. See |RST_LINK_CONFIG_EDITOR| on how to change these values. .. _ch-webapp-admin-user-edit-password: Password ^^^^^^^^ .. figure:: ../images/manual/screenshots/admin/sp-01-02-user-password-actions.png :alt: Admin Web App: Internal User - Password Actions :width: 400 Admin Web App: Internal User - Password Actions For an :ref:`Internal User ` |RST_GUILABEL_PASSWORD| actions are shown. The |RST_BUTTON_ERASE| button is shown when a password is set. When pressed, it erases the password and makes itself disappear again. Without an initial password, users cannot reset their password in the :ref:`User Web App `. *This gives administrators a means to disable login by user name/password, in favor of other authentication methods.* A tap on the |RST_BUTTON_RESET| button shows the :ref:`Password Reset Dialog `. This dialog is also used to initially set or change a password. Use the |RST_BUTTON_EYE_SYMBOL| button on the right side of the entry fields show/hide the password. .. _ss-admin-user-password-reset: .. figure:: ../images/manual/screenshots/admin/sp-01-02-user-password-reset.png :alt: Admin Web App: Internal User - Password Reset :width: 400 Admin Web App: Internal User - Password Reset .. _ch-webapp-admin-user-edit-delete: User Delete ^^^^^^^^^^^ .. figure:: ../images/manual/screenshots/admin/sp-01-02-user-edit-delete.png :alt: Admin Web App: Edit User - Delete :width: 400px Admin Web App: Edit User - Delete - Press the |RST_BUTTON_DELETE| button to delete the user and return to the User List. The :ref:`next ` section describes the effect of this action. - The |RST_BUTTON_CANCEL| button bring you back to the User List without changing anything. .. _ch-webapp-admin-user-create-internal: Create Internal User ~~~~~~~~~~~~~~~~~~~~ A tap on the |RST_BUTTON_NEW_3_DOTS| button at the top of the :ref:`User List ` gives this dialog to create a new :ref:`Internal User `. Apart from the regular User data, the attributes |RST_GUILABEL_ID|, |RST_GUILABEL_PIN| and |RST_GUILABEL_PASSWORD| can be entered. - The prefix of |RST_GUILABEL_ID| is contained in the configuration key ``internal-users.username-prefix``. - The |RST_GUILABEL_PIN| must be digits only. The minimum and maximum length of a PIN are contained in the configuration keys ``user.pin-length-min`` and ``user.pin-length-max``. A maximum value ``0`` (zero) indicates the maximum is unspecified. - The minimum length of the |RST_GUILABEL_PASSWORD| is contained in the configuration key ``internal-users.password-length-min``. - See |RST_LINK_CONFIG_EDITOR| on how to change these configuration values. - The |RST_GUILABEL_FINANCIAL| data are initialized with the :ref:`New User Settings ` of the :ref:`Built-in Internal Users Group `. If these new user settings are disabled the |RST_GUILABEL_BALANCE| is set to zero with an |RST_BUTTON_INDIVIDUAL| Credit limit of zero. .. note:: Internal Users can also be created by :ref:`Self Registration `. .. tip:: Internal Users can also be added with the Server Command Tool. See :ref:`addInternalUser `. .. _ch-webapp-admin-users-deleted: Deleted Users ~~~~~~~~~~~~~ Deleting a User makes sense if they are not part of the user source anymore and they were not deleted as part of a bulk delete during a manual synchronization. As long as job history or account transactions for a User are present [5]_ , SavaPage applies a logical delete. Any logical deleted User will be physically deleted from the database when no related job history and account transactions are present anymore. This situation will automatically occur when you enabled :ref:`automatic backup ` in combination with the delete of old document and transaction logs. .. important:: If SavaPage synchronizes a new User from the user source, a new user instance will be created in the database, despite the fact that a logical deleted User exists with the same identifying name, i.e. the logical delete status of the "identical" user will remain as it is. .. [5] When a user does not print on their own, but is printed for via Delegated Print, no job history is present for that user, but (pending) transactions are. .. _ch-webapp-admin-users-admin: Administrator Role ~~~~~~~~~~~~~~~~~~ SavaPage sets up a dedicated account called ``admin``. This is the master administrator account, with access to all application functions, whose password is assigned during configuration. In large organizations it is likely that the administrator role needs to be granted to more than one person. One solution is to give all those persons the master password; however a better approach is to assign the administrator role to the network user accounts of these individual's. The advantages of this approach are: - Administrators can access the Admin Web App with their own username and password. - Since most administrative activity is logged in an audit trace, changes can easily be tracked back to an individual. .. note:: Access to certain parts of the Admin Web App can be set on User Group level with :ref:`Admin Privileges `. .. tip:: Administrative users should login via ``https://savapage:8632/admin`` rather than ``https://savapage:8632/`` or ``https://:savapage:8632/user`` so that they are directed to the right interface.