Sign in and first setup
A fresh G8 server has no users. Its first start prints a setup token, the console turns that token into the first administrator, and from then on everyone signs in on one form, local accounts and directory accounts alike. This page follows that path and then the account menu every signed-in person has at the top right of the console.
Who may open it
The setup form is open to anyone who can reach the console, and only while the server has no users. The sign-in form is open to anyone. The account menu belongs to whoever is signed in and changes only their own account.
The first start
At every start the server counts its users. While there are none, it reads the setup token from its database or makes a new one, stores it sealed under the secrets key, and prints a warning in its log. The warning says that g8 has no users yet, asks you to open the console and create the first administrator with the setup token, and adds that every replica of this install prints the same one. The token is in the field setup_token.
Every replica prints the same token because each one unseals the same stored row. The token is five groups of four characters joined by hyphens. Once the first administrator exists, the token is deleted from the database and no later start prints one.
Create the first administrator
Open the console. While the server has no users, the sign-in page sends you to Create the first administrator, which says: g8 has no users yet. Enter the setup token from the server log, then create the platform administrator account. Fill in the form.
| Field | What to enter |
|---|---|
| Setup token | The token from the log. The help under it says: Printed in the server log while g8 has no users. Spaces around it are ignored. |
| Display name | The name the console shows for this person. |
| Username | The name used to sign in, in letters, digits, dots and hyphens. |
| Optional | |
| Password | At least 12 characters. |
Select Create administrator. The server checks again that no user exists and that the token matches, creates a local user, gives it the Platform administrator role in every environment and deletes the stored token. Two rows go to the audit log, one for the administrator created and one for the role granted. The console then signs you in with the same username and password and opens the overview.
A token that does not match answers: The setup token is not valid. Copy it from the server log and try again. When an administrator already exists, the form says: An administrator exists already. Sign in instead. The per-address limit on sign-in attempts applies to this form too.
Sign in
The form is titled Welcome back. Enter the Username and the Password and select Sign in.
Local and directory accounts use the same form. The server looks the username up: a local account is checked against its stored password, and any other name goes to the directory when one is connected. Connect Active Directory describes the directory path.
A wrong password, an unknown name, a disabled account and a locked account all get the same answer: Check your username and password, then try again. Each failed attempt on a local account is counted. After the configured number of failures within the configured window, the account is locked for the configured time, and the lock lifts on its own. While it is locked, a right password is refused like a wrong one. Too many attempts from one address answer: Too many sign-in attempts from this address. Wait a minute, then try again.
The number of failures, the window, the lock time, the per-address limit and the session lengths are settings of the server, listed under Sessions and sign-in. Every sign-in, failed sign-in and lockout is recorded in the audit log. How long a session lives and what ends it is on Users, roles and access. When a session ends while you work, the form says: Your session ended. Sign in again to continue.
A password set by an administrator
A password an administrator typed into a new user's form, or generated with a reset, is temporary. After signing in with it, the console opens Change your password, which says: Your password was set by an administrator. Choose a new one before you continue.
Nothing else opens first. The server answers every other request with a refusal carrying the reason password_change_required, apart from reading the session, changing the password and signing out, and the console sends you back to this page. Enter the Current password and a New password; the help says: At least 12 characters. The new password must differ from the current one. Select Change password, and the console continues to the page you were heading for. Changing the password signs out your other sessions. The Sign out link under the form leaves without changing it.
The account menu
The button at the top right, labelled Account, shows your display name, whether the account is Local or Active Directory, and your role in one line. It opens four items.
Preferences
Preferences opens a dialog with two choices. Density is Comfortable or Compact and sets the height of table rows. Sidebar is Expanded or Collapsed, the same choice as the collapse control on the sidebar itself. Each choice is saved on the server against your account the moment you select it, and the dialog says so: Changes apply right away and follow you to every browser. The same record keeps the environment you opened last, so the console returns to it at your next sign-in.
Change password
Change password is shown to local accounts only. A directory account's password lives in the directory, and the item is absent. The dialog asks for the Current password and the New password, and its help says: At least 12 characters. Your other sessions are signed out. The server checks the current password, refuses a new one equal to it, stores the new one and ends every other session of yours.
Sign out everywhere
Sign out everywhere asks first: Every other session of yours ends now, on every browser and device. This one stays signed in. On confirmation the server revokes every session of yours except this one and writes one audit row per session; the console then says how many were signed out. A Platform administrator does the same for another person from the user's page, with Sign out everywhere.
Sign out
Sign out ends this session, records the sign-out in the audit log and returns to the sign-in form.
Help & about
The last entry of the sidebar, under the navigation, is Help & about. In this version it opens a page that says the area is not available yet, with the sentence: This area of the console is still being built. The navigation already shows where it will live. The line under it in the sidebar names the product with the version and the short commit of the server you are connected to.
Related
- Users, roles and access: the roles, creating local users, sessions and passwords, and what a Viewer sees.
- Connect Active Directory: sign-in with a domain account and roles by group.
- Server configuration: the lockout, rate and session settings.
- Audit log: where sign-ins, lockouts and sign-outs are recorded.
- First sign-in and the first environment: the same steps as a session of the course.