---
alias: operation-guide-security-portal-strategy-local
description: "Utilize local user accounts for system access via username and password authentication"
---

# Local User Accounts

The **Local User Accounts** strategy signs in users with a user name and password stored in the MES database. The accounts exist only in MES, so no external authentication source is needed.

!!! warning
    This strategy is not recommended for production environments, because it lacks security features such as multi-factor authentication (MFA).

![Local Authorization Flow][security_portal_local_authorizationflow]

## Configuration

Available out of the box with the ID `LocalUsers`. It is always enabled.

### Parameters

| **Strategy type**    | **Plugin**                                 |
|----------------------|--------------------------------------------|
| `local-CoreDatabase` | `@criticalmanufacturing/auth-plugin-local` |

Table: Local User Accounts strategy type and plugin

Each strategy entry also accepts the [common strategy properties](../security-portal-configuration/security_portal_config_securityportal.md#common-strategy-properties).

| **Parameter**                  | **Required** | **Description**                                                                                                                                           |
|--------------------------------|--------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------|
| `storage`                      | Yes          | Connection to the database that stores the user accounts. Usually the MES database, but it can be a different database from the one of the tenant. See [Database Connection](../security-portal-configuration/security_portal_config_securityportal.md#database-connection). |
| `disableIntegrationUsersLogIn` | No           | Blocks integration users from signing in interactively. Default: `true`.                                                                                  |
| `resetToken.secret`            | No           | Secret used to sign password reset tokens. Without `resetToken`, password reset is not available.                                                         |
| `resetToken.validFor`          | No           | Validity of a password reset token, for example `24h`.                                                                                                    |
| `mail.from`                    | No           | Sender address of the password reset emails.                                                                                                              |
| `mail.transport`               | No           | SMTP server settings: `host`, `port`, `secure` (use TLS), and `auth` (`user` and `pass`).                                                                 |

Table: Local User Accounts strategy parameters

### Example

```json
{
  "id": "LocalUsers",
  "displayName": "Local Users",
  "type": "local-CoreDatabase",
  "config": {
    "disableIntegrationUsersLogIn": true,
    "storage": {
      "user": "<User>",
      "password": "<Password>",
      "database": "<OnlineDatabase>",
      "server": "<DatabaseServer>",
      "port": 1433,
      "options": {
        "encrypt": true
      }
    },
    "resetToken": {
      "secret": "<Secret>",
      "validFor": "24h"
    },
    "mail": {
      "from": "<no-reply@example.com>",
      "transport": {
        "host": "<SMTPServer>",
        "port": 25,
        "secure": false,
        "auth": {
          "user": "<User>",
          "pass": "<Password>"
        }
      }
    }
  }
}
```

[security_portal_local_authorizationflow]: ../../images/security_portal_local_authorizationflow.jpg