# Administering users

## Creating and deleting users

Users can be created and deleted by logging in as admin, and visiting the user management page at "/profile/user-list.html". For example a server on your own machine can be managed from http://localhost:8080/profile/user-list.html. Click the button to create a new user. To delete a user, click the button in the "Action" column next to the user to be deleted.

You can also create a user via the Orion server API. Use curl or another utility to send a POST request to "/users". The form requires the following parameters: "login" (user login id), "password" (initial password) and "passwordConf" (confirm password).

## Changing passwords

To change a user's password, go to user-list.html. From there, click on a user to view that user's profile page. On the user profile page you can change the password, change the user's display name, etc. Each user can also change their password by selecting "Profile" from the drop-down menu in the top right corner of the Orion UI.

## Allowing users to create accounts

By default, any user is allowed to create an account. To disallow anonymous account creation, you can specify what user ids are allowed to create accounts via the `orion.auth.user.creation` property in the server configuration file.

    orion.auth.user.creation=admin

When this property is specified, account creation can only be performed on the user management page. This page is currently only accessible for the admin user.

## Requiring users to add email while creating account

By default, user email is optional, however this may be changed via the `orion.auth.user.creation.force.email` property in the server configuration file.

    orion.auth.user.creation.force.email=true

When this property is specified as true, users are required to provide an email address while creating the Orion account. Immediately after creating the user account an email will be sent to the provided address requesting confirmation. The account is confirmed by clicking on the generated link provided in the email. The user will be able to log in only after the given email address is confirmed. This option will only work correctly when email configuration is correctly set. See email configuration section for directions.

## Creating an admin user

No accounts are built into the Orion server by default. This avoids a vulnerability caused by well-known users and passwords that administrators neglect to change. While a small-scale server might not require an admin user at all, it is useful to create an admin account for larger-scale user management (seeing list of all users, adding/deleting users, etc). To create an admin account, add following line to the server configuration file (but please use a more creative password):

    orion.auth.admin.default.password=abracadabra

This will cause an administrator account to be created as the server starts up. The admin user name is "admin" and the password will be the value specified by the configuration property. Once the admin account has been created, the configuration property is no longer required on startup (the admin password can be changed later by logging in as the administrator and going to the profile management page).