User Management¶

Manage multiple users with role-based access control for your CertifyClouds deployment.

Overview¶

PRO tier enables multi-user support with:

• Multiple user accounts
• Role-based access control
• SSO auto-provisioning
• Account security features

User Roles¶

CertifyClouds supports two roles:

Permission Matrix¶

Managing Users¶

Create User¶

1. Go to Settings → Users
2. Click Add User
3. Enter:
4. Username: Unique identifier
5. Email: User's email address
6. Password: Initial password (must change on first login)
7. Role: Admin or User
8. Click Create

Edit User¶

1. Go to Settings → Users
2. Click the edit icon on a user
3. Modify:
4. Email address
5. Role
6. Account status (enabled/disabled)
7. Click Save

Delete User¶

1. Go to Settings → Users
2. Click the delete icon on a user
3. Confirm deletion

Reset Password¶

1. Go to Settings → Users
2. Click on a user
3. Click Reset Password
4. Generate or enter new password
5. Share with user securely

SSO User Provisioning¶

When SSO is configured, users can be auto-provisioned on first login.

Configure Auto-Provisioning¶

1. Go to Settings → SSO Configuration
2. Enable Auto-create users
3. Set Default role for new SSO users
4. Save

How It Works¶

1. User clicks "Sign in with SSO"
2. Authenticates with identity provider
3. If user doesn't exist and auto-create is enabled:
4. New account created with SSO identity
5. Default role assigned
6. User logged in
7. If user exists:
8. Existing account linked to SSO
9. User logged in

SSO-Only Mode¶

Disable local password authentication:

1. Go to Settings → SSO Configuration
2. Enable SSO-only mode
3. Save

Account Security¶

Password Requirements¶

Local accounts must have passwords that meet:

• Minimum 12 characters
• At least one uppercase letter
• At least one lowercase letter
• At least one number
• At least one special character

Account Lockout¶

After repeated failed login attempts:

Unlock Account¶

Admins can manually unlock accounts:

1. Go to Settings → Users
2. Find the locked user
3. Click Unlock Account

Session Management¶

Audit Trail¶

All user-related actions are logged:

• User created/modified/deleted
• Login attempts (success/failure)
• Password changes
• Role changes
• Account locks/unlocks

View in Audit tab or filter by user.

Best Practices¶

Initial Setup¶

1. Create individual accounts - Don't share admin credentials
2. Use SSO - Integrate with corporate identity for better security
3. Least privilege - Assign User role unless Admin is needed

Ongoing Management¶

1. Regular reviews - Audit user list quarterly
2. Disable inactive - Disable accounts for departed team members
3. Monitor logins - Review audit logs for unusual activity

Security¶

1. Enable MFA - Use SSO with MFA enforcement
2. Strong passwords - Enforce complexity requirements
3. Session limits - Configure appropriate timeouts

API Reference¶

List Users¶

GET /auth/users

Create User¶

POST /auth/users
Content-Type: application/json

{
  "username": "jsmith",
  "email": "jsmith@company.com",
  "password": "SecurePassword123!",
  "role": "user"
}

Update User¶

PUT /auth/users/{user_id}
Content-Type: application/json

{
  "email": "john.smith@company.com",
  "role": "admin"
}

Delete User¶

DELETE /auth/users/{user_id}

Get User Security Status¶

GET /auth/users/{user_id}/security-status

Unlock User¶

POST /auth/users/{user_id}/unlock