Staff & Security

The owner and other staff #

The installer made the owner: it has every permission, and nobody else can change that account. Add the people who work with you under Staff in the admin menu.

For each staff member you set their name, email, username and password, and give them a role.

Roles #

Settings > Roles lists the roles and what each may see and change. A role is a set of permissions, grouped by area (clients, invoices, orders, products, settings and so on). Each area has separate read, create, update and delete permissions, and some have special ones.

• Give people the narrowest role that lets them do their job. Support staff need clients and tickets, not gateway keys.
• The Settings permissions control the Settings cards: a member of staff without them sees an empty Settings page.
• Changing a role takes effect on the person's next page.

Security settings #

Settings > Security holds:

• Session lifetime: how long a sign-in stays alive when nothing is clicked (an idle timeout; activity keeps it alive). The default is one hour.
• Minimum password length: and the rules passwords must meet (upper case, lower case and a number).
• Let clients register themselves: with this off, only staff can create client accounts.

Two-factor sign-in #

Staff and clients can turn on two-factor sign-in with an authenticator app. After the password they enter a six-digit code, or one of their recovery codes.

• A person turns it on from their own account page, and must give their password and a code to turn it off again.
• If somebody has lost their phone and their recovery codes, a member of staff with the right permission can turn two-factor off for them on the staff screen. This is recorded in the activity log.

Encourage everyone with access to the admin to use it.

Signing in as a client #

Staff can sign in as a client to see what they see. While they do, the client's security settings are locked and the staff member's own permissions still apply. Everything done is logged against the staff member.

The activity log #

Logs > Activity records who did what: sign-ins, changes to settings, payments recorded, services changed. Lines link to the records they are about. Logs > Errors shows problems LBM had.