Accounts and people
Add each person once, give them their apps, and choose whether they also get a WebUI login, choose what they can do from five ready-made ranks or tick it yourself, and see who changed what.
On this page
For a long time the WebUI had a single login, shared by whoever looked after the server. Now everyone can have their own. You stay the Owner, and you decide for each person whether they can run the whole server, just keep it ticking over, only look, or only open the apps you pick.
This is about who can sign in to LibrePortal itself. The people you share apps with still have accounts inside those apps, as before. Nothing here needs a domain: accounts work on a plain http://192.168.1.50:port address like everything else.
Users is now People
Since 0.10.11 the list under Admin is called People. Every person you add also gets an Authelia sign-in with the same username and password, so one login opens their apps (see Sign-in explained). Control-panel access is now an optional extra: the default rank is None — apps only, and that person is simply refused at the control panel. Wherever this page says Users, read People.
Your own login is the Owner#
If you had a WebUI login before, it is now the Owner account. You don't do anything and nothing changes when you sign in. It is also the account that libreportal webui login show and libreportal webui login reset work on, so those still do what they always did.
An Owner can do everything and can't be restricted. There is always at least one. You can make a second Owner if you want a partner to have the same rights, but think about it first: no one can demote, disable or remove another Owner. An Owner steps down on their own account, and the last Owner can't step down.
The ranks#
When you add someone you pick a rank. Each one is a ready-made set of rights, so most of the time you choose and you're done.
| Rank | Good for | What they can do |
|---|---|---|
| Owner | You | Everything. |
| Co-admin | A partner you trust | Everything on every app and setting: install, update, back up, restore, see passwords, read the Activity page, add and manage people below Co-admin. Not the security pages (Access, VPN, Connect, SSH Access, the WebUI login) unless you give them. |
| Looks after apps | The person who keeps things running | See every app and the system. Start, stop and restart, run tools that don't touch passwords, back up, update, read logs and tasks. They can't change settings, install, restore, see passwords or open the security pages. |
| Can look around | "Look, don't touch" | See apps, their status and their settings, read-only. Nothing can be changed, and passwords and security settings stay hidden. |
| Just some apps | Family and friends | The Dashboard, plus the apps you tick for them, which they can see and open. Nothing else. |
| None — apps only | Most of your household | No control-panel access at all. They sign in to their apps with one username and password and are refused here. |
| Custom… | Anything in between | You pick the apps and settings yourself. |
A few things stay with Owners
Resetting or restoring the whole server, the setup wizard, the WebUI's own login settings and making or removing Owners can't be given to anyone else, whatever their rank.
Adding someone#
- Open Admin → People and press Add person. The People page lists everyone, with their rank and whether they're signed in right now.
- Who. Give them a name. LibrePortal suggests a username from it: 2 to 32 characters, lower-case letters, numbers, dots, dashes and underscores.
- Control panel and apps. Choose their Control panel rank (the default is None — apps only), then the apps and groups they may open. For a rank that can use the panel, choose what they can do. For Just some apps, tick the apps. For Custom…, pick a level for All apps and for each app, and whether they can see or change the server settings.
- Sign-in. Choose how they get in the first time. An Invite link works once, for 72 hours, and lets them choose their own password. A One-time password is made up for them and they change it when they sign in. Or you can type one yourself.
- Send it. You see the link (with a QR code; scanned with the LibrePortal app it opens straight in Join a server, see Connect the app) or the password once, with a Copy button. It isn't shown again, but you can make a new one from their page.
No default passwords, even for a moment
There's no step where a new person has a password you typed or a standard one. Either they choose it themselves from your link, or LibrePortal makes a random one that only works until they change it. Passwords need at least 12 characters.
Ranks are offered only if you may hand them out. A Co-admin never sees Co-admin in the list, because only Owners manage Co-admins.
Fine-tuning one person#
Open a person's page from the People list. It has a few cards:
- Rank: change it with Change rank.
- Apps & groups: which apps and dashboards they may open. VPN devices lists their devices. If their control-panel and app passwords ever differ, a note says so and Set one password now unifies them.
- Extra access: more or less than their rank gives, for particular apps. Press Edit, add an app and choose a level. Extra access lists what you've added and Exceptions lists what you've taken away. The levels are No access, See, Open, Operate, Manage and Full. For example, "Looks after apps, plus Manage on Jellyfin", or "Co-admin, but No access to Vaultwarden".
- Sign-in: make a New invite link or New one-time password, or Turn off 2-step if they've lost their phone (see Two-step sign-in).
- Where they're signed in: their devices, with Sign out, and Sign out everywhere.
- Account: Disable them, which signs them out everywhere and stops them signing in until you press Enable, or Remove them, which takes out their Authelia sign-in too. Their old entries on the Activity page keep their name.
If someone can't see something at all, it isn't there for them: no menu entry, no tab, no field. If they can see it but not change it, it shows with a small lock.
People Authelia already had#
If Authelia already knew someone, they show up on the list by themselves with the rank None — apps only. When a control-panel account and an Authelia person might be the same human but have different usernames, LibrePortal asks "Is … also …?" and joins them only after Authelia confirms the password. If Authelia isn't installed yet, the page says so quietly, and one click adds everyone to it once it is.
Your own roles#
For something the ranks don't cover, open Admin → Roles. The five built-in ranks are listed first, and you can open one to see exactly what it allows, but they can't be edited, so they always mean the same thing. Press New role, or duplicate one, to make your own.
A role is a list of what its members may do, in three parts:
- Apps: a row for every app, plus All apps and Apps installed later. The columns are what someone can do: see, open, use tools, change settings, install, back up, restore, update, see passwords, read logs. Each box is allowed, turned off, or follows the row above. The row presets (None, See, Operate, Manage, Full) fill a row in one go.
- Settings: the server's settings and each app's settings tab, down to a single setting. Each is Hidden, Read-only or Editable, and the most specific choice wins. "Everything read-only, except the swap size" is one tick.
- Pages: Tasks, Updates, System, Branding, Users, Activity and the security pages, each on or off.
A role also has Require 2-step sign-in and Sign out after. A role can't hand out more than the person making it has.
One device at a time#
Each account can be signed in on one device at a time. When someone signs in somewhere new while they're already signed in elsewhere, they're asked:
You're signed in on another device. Sign in here instead?
If they say yes, the other screen is signed out, and says where and when it happened, with a button to sign in again. That one takes it back, but it needs the password again.
It's a deliberate choice, and it keeps a forgotten tab on a shared computer from staying open for ever. For someone who really needs a phone and a computer at once, switch on Can be signed in on several devices on their page.
People are also signed out after two hours without touching the keyboard or mouse. The time is set per role, with Sign out after. All the tabs in one browser count as one device.
My account#
Everyone has My account, reached from the menu in the top bar. It's where you change your display name and password, set up two-step sign-in, and see where you're signed in. Changing your password signs out your other devices.
Seeing who did what#
Admin → Activity is a plain list of what happened: sign-ins, people and roles changed, settings changed, tasks started, passwords revealed. Owners and Co-admins can read it, and nobody can edit it. It keeps 12 months. Passwords and keys are never shown, only that they were changed. Owners can export the list as a CSV file.
If someone is locked out#
Too many wrong passwords slow things down: after five wrong tries for one username, each further try waits a little longer, up to 15 minutes. The server's shell gets you back in whatever happens, even with the WebUI down:
Advanced Do this from the command line
sudo -u libreportal libreportal webui user list
sudo -u libreportal libreportal webui user reset sam
New to the command line? How to run LibrePortal commands →
reset makes a new random password and shows it once. The other commands are add, promote, demote, disable, enable, unlock, 2fa-off and signout. If you ever lose the Owner login itself, libreportal webui login reset is still there. See Troubleshooting.
The server can do more than the WebUI lets someone do
These ranks decide what a signed-in person can ask LibrePortal to do. Anyone with a shell on the server, or with the sudo password, is an Owner in effect. Share the WebUI with people you'd be happy to share it with.