Administering users | ||
---|---|---|
![]() |
![]() |
|
Configuring the server | Ongoing server management |
Users can be created and deleted by logging in as admin, and visiting the user management page at "/profile/user-list.html". For example a server on your own machine can be managed from
http://localhost:8080/profile/user-list.html. Click the button
to create a new user. To delete a user, click the
button in the "Action" column next to the user to be deleted.
You can also create a user via the Orion server API. Use curl or another utility to send a POST request to "/users". The form requires the following parameters: "login" (user login id), "password" (initial password) and "passwordConf" (confirm password).
To change a user's password, go to user-list.html. From there, click on a user to view that user's profile page. On the user profile page you can change the password, change the user's display name, etc. Each user can also change their password by selecting "Profile" from the drop-down menu in the top right corner of the Orion UI.
By default, any user is allowed to create an account. To disallow anonymous account creation, you can specify what user ids are allowed to create accounts via the orion.auth.user.creation property in the server configuration file.
orion.auth.user.creation=admin
When this property is specified, account creation can only be performed on the user management page. This page is currently only accessible for the admin user.
By default, user email is optional, however this may be changed via the orion.auth.user.creation.force.email property in the server configuration file.
orion.auth.user.creation.force.email=true
When this property is specified as true, users are required to provide an email address while creating the Orion account. Immediately after creating the user account an email will be sent to the provided address requesting confirmation. The account is confirmed by clicking on the generated link provided in the email. The user will be able to log in only after the given email address is confirmed. This option will only work correctly when email configuration is correctly set. See email configuration section for directions.
No accounts are built into the Orion server by default. This avoids a vulnerability caused by well-known users and passwords that administrators neglect to change. While a small-scale server might not require an admin user at all, it is useful to create an admin account for larger-scale user management (seeing list of all users, adding/deleting users, etc). To create an admin account, add following line to the server configuration file (but please use a more creative password):
orion.auth.admin.default.password=abracadabra
This will cause an administrator account to be created as the server starts up. The admin user name is "admin" and the password will be the value specified by the configuration property. Once the admin account has been created, the configuration property is no longer required on startup (the admin password can be changed later by logging in as the administrator and going to the profile management page).
![]() |
![]() |
![]() |
Configuring the server | Ongoing server management |