Users
A user can authenticate via the UI or to the API (See REST API)
A user account can be a member of a team and, via the team permissions, then has access to specific Certificate Issuers
The management of Active Directory users remains with Active Directory - you cannot edit those accounts here, although when an AD user logs in, their account will show up in the list of users
Users may also be sent emails on certificate issuance and reminders when certificates are nearing expiry
Creating a User Account
As an administrator, select Users from the menu
Click Add New User
Enter a Username and an Email Address
For the password, you can choose a password for the user or you can click Generate random password and email. This will generate a strong password and email to the email address configured. By default, the user will also have to change this password on first use
See Email Settings to edit the message that is sent to the user
You can also just set a password manually and also have the option at any time of selecting the Force change at next login
Choose the team(s) to add the user to. Note that if no team is chosen, the user will be able to login but will be unable to request any certificates as Certificate Issuer permissions are managed at the team level
Click Add
Note you cannot add Active Directory accounts - they are still managed via Active Directory and what they can access in the system is defined by the group mappings made to Teams
Editing and Deleting Users
Select Users from the menu and click on the user account you wish to update
Click Edit or Delete as required
Note that when editing a user, if you do not enter a new password the existing password will remain set. Thus, you may edit the email address, team membership and whether the account is enabled or not without having to reset the password
Editing a user also displays the last login time and IP address
If the account is an Active Directory you will be unable to make any changes as all details are managed by Active Directory
API Tokens
API tokens can be issued from user accounts. These can then be supplied to applications that need to call the REST API and remove the need to first login with a username and password, as the token is simply supplied in the Authorization header element
To generate a new token, edit an existing user
Under API Token, set the validity required for the token then click Generate Token
A token will be generated. Click the token to copy and save the value. This value will only be displayed once and cannot be retrieved later if lost
This value must then be included in the Authorization header when making REST API calls
Note, it is linked with the user account so has the same permissions (access to Certificate Issuers) and restrictions (IP Addresses)
Tokens cannot be revoked individually. It is therefore advised that a specific API account be setup that can be disabled if required. This will prevent any valid API tokens from being used further