Local User Accounts#

The Local User Accounts strategy signs in users with a user name and password stored in the MES database. The accounts exist only in MES, so no external authentication source is needed.

Warning

This strategy is not recommended for production environments, because it lacks security features such as multi-factor authentication (MFA).

Configuration#

Available out of the box with the ID LocalUsers. It is always enabled.

Parameters#

Strategy type	Plugin
`local-CoreDatabase`	`@criticalmanufacturing/auth-plugin-local`

Table: Local User Accounts strategy type and plugin

Each strategy entry also accepts the common strategy properties.

Parameter	Required	Description
`storage`	Yes	Connection to the database that stores the user accounts. Usually the MES database, but it can be a different database from the one of the tenant. See Database Connection.
`disableIntegrationUsersLogIn`	No	Blocks integration users from signing in interactively. Default: `true`.
`resetToken.secret`	No	Secret used to sign password reset tokens. Without `resetToken`, password reset is not available.
`resetToken.validFor`	No	Validity of a password reset token, for example `24h`.
`mail.from`	No	Sender address of the password reset emails.
`mail.transport`	No	SMTP server settings: `host`, `port`, `secure` (use TLS), and `auth` (`user` and `pass`).

Table: Local User Accounts strategy parameters

Example#

{
  "id": "LocalUsers",
  "displayName": "Local Users",
  "type": "local-CoreDatabase",
  "config": {
    "disableIntegrationUsersLogIn": true,
    "storage": {
      "user": "<User>",
      "password": "<Password>",
      "database": "<OnlineDatabase>",
      "server": "<DatabaseServer>",
      "port": 1433,
      "options": {
        "encrypt": true
      }
    },
    "resetToken": {
      "secret": "<Secret>",
      "validFor": "24h"
    },
    "mail": {
      "from": "<[email protected]>",
      "transport": {
        "host": "<SMTPServer>",
        "port": 25,
        "secure": false,
        "auth": {
          "user": "<User>",
          "pass": "<Password>"
        }
      }
    }
  }
}