---
alias: user-guide-security-users
description: "This documentation outlines how to manage users within the system, including creating, editing, deleting, assigning roles, and generating access tokens"
---

# Users

:lock: Administration.**Security**

## Users Overview

The list of users is available by selecting **Users** on the landing page of the **Security** entity.
![security_user_list][security_user_list]

The **Users** page displays general information on the specific user, such as:

* **User** - the name of the user.
* **Account** - the Account associated with the user.
* **Last Login On** -  the date and time of the user's most recent login, displayed in the format `MM/DD/YYYY` and `hh:mm AM/PM` (12-hour format).
* **Last Login From** - the IP address or host name of the machine from which the user last logged in.
* **Roles** - the number of Roles associated to the user.
* **Features** -  the number of Features to which the user has access.
* **Data Groups** - the number of Data Groups to which the user belongs.

In addition, this page enables you to execute all the operations that can be performed on a specific user. When you select a specific user, the **Details** Tab provides a collapsible Details View panel on the left side of the page. The panel will display some or all of the following sub-sections:

* **Details** - displays general information on the user.
* **Roles** - displays information on the Roles to which the user belongs.
* **Features** - displays information on the Features to which the user has access.
* **Data Groups** - displays information on the Data Groups to which the user belongs.
* **Access Tokens** - displays information on the Access Tokens that the user has generated.
* **Public Keys** - displays information on the Public Keys that the user has added.
* **Devices** - displays information on the Devices used by the user to access the system and which they registered upon logging in.

![security_user_page_details_view][security_user_page_details_view]

## Default System Users

Critical Manufacturing MES provides a set of default users that support system execution, authentication mechanisms, and access to the environment. The following users are available by default:

* **Administrator** - the only default user who can log in through the user interface. This user provides access to the environment after installation, ensuring that there is at least one user able to access and configure the system.

* **MES** - the MES user is created to allow authentication using client credentials for the client that is shipped by default with Critical Manufacturing MES. It is used as part of the authentication mechanism for system-provided clients.

* **System** - used to associate actions that are performed by the system. It does not represent a real user, but rather an internal identity used for system-executed actions. Examples include migration scripts, upgrade-related operations, timers, scheduling, and other operations performed automatically by the system.

!!! info
    Similar to the MES user, additional default users are created by installed applications. These users serve the same authentication purpose and are automatically created with a name that matches the corresponding application.

## Creating a User

:lock: User.**Create**

To create a user in the application, you should open the **Users** page and select **Create** on the top ribbon:

1. Provide the Account name for the user as defined in the Active Directory. For users from more than one Active Directory domain, see [[operation-guide-multipledomains]].
2. Provide a Name and an Email Address. If not provided, this information may be retrieved from Active Directory.

    !!! warning "Mandatory Email Address and Active Directory Integration"

        An Email Address is mandatory when creating a user, even though the field may not be visually marked as mandatory in the user interface. For users without an e-mail account, you can use an internal or generated Email Address, provided it is well-formed (for example, `user_test01@company_test.com`).
        
        * If no Email Address is provided, the system attempts to retrieve it from Active Directory.  For more information, see [[operation-guide-security-portal-strategies-index|Security Portal - Strategies]].
        * User creation will fail if an Email Address is neither provided manually nor retrieved automatically. Default system users are managed by the system and may be subject to different rules.
        * For users who will use [[user-guide-ai-index]], the Email Address must be unique. An internal or generated Email Address can be used, provided it is well-formed and not assigned to another user.
        * The Email Address is also used for password recovery, when applicable.

3. Optionally, specify the Primary Role of the user. If a Primary Role is specified, the user will be automatically added to that Role as part of this transaction.

    !!! warning
        For a new user to log in to MES, they must be assigned the `MES` OAuth Role (or belong to the `Administrator` role). Without it, the user will receive a message error at login. See [[user-guide-security-roles#creating-a-role]] for more information on OAuth Scope Roles.

4. Specify whether the account refers to an Integration User. An Integration User is typically used for equipment integration in order to relax some functional restrictions like forcing the user to be checked-in at the resource.

    !!! info
        If the Integration User property is set to `true`, the Enable Step Certification Requirements will not be available. For more information, see [[user-guide-create-step]].

5. Specify whether the user is Enabled in the system (it defaults to `true`). A user that is not Enabled will not be allowed to log in to the system.
6. Optionally, define an Auto-Lock Timeout, in seconds:

      * If not defined, it takes the default value as stored in the configuration of the application, which is stored in the path `/Cmf/Guis/Configuration/Common/Security/AutoLockTimeout/`.
      * If defined as `0`, the Auto-Lock Timeout user session never times out.

7. Optionally provide the following information:

      * PIN - a personal identification number that can be used in combination with the token for keyboard wedge used identification and authentication (can be alphanumeric and letters used must be capitalized).
      * Token - the user token in case that a keyboard wedge device is configured for user identification and authentication.  

8. Optionally specify the Authentication Strategy that should be followed by the Security Portal.

    !!! note
        This setting only applies if the Security Portal is configured with more than one Authentication Strategy.

9. Optionally provide a Password - an alphanumeric string to ensure private access to the system.
10. Specify if the user will be prompted to change the password on the next log in.

    !!! note
        This setting is only applicable when the environment is configured to use the Security Portal with a local Authentication Strategy.

11. Select **Create** to complete the transaction.

    !!! warning
	    There is currently no support for non-ASCII characters in user account names.

    ![security_user_create][security_user_create]

## Editing a User

:lock: User.**Edit**

To edit a user, you need to:

1. Open the **Users** page.
2. Select the user you want to edit.
3. Select **Edit** on the top ribbon.
4. Make the necessary changes.
5. Select **Save** to commit the data to the database.

    ![security_user_edit][security_user_edit]

## Deleting a User

:lock: User.**Delete**

To delete a user, you need to:

1. Open the **Users** page.
2. Select the user you want to delete.
3. Select **Delete** on the top ribbon.
4. Select **Delete** to commit the data to the database.

    ![security_user_delete][security_user_delete]

## Assigning Roles to a User

:lock: Role.**Edit**

To assign one or more **Roles** to a user, you need to:

1. Open the **Users** page.
2. Select the user and, in the **Details** view, select the **Roles** sub-section in the Details View panel.
3. Select the **Assign** button.
4. Select the desired **Roles** for the user - note that only the **Roles** that the user does not belong to are shown.
5. Select **Assign** to complete the operation.

    ![security_user_assign_roles][security_user_assign_roles]

## Unassigning Roles from a User

:lock: Role.**Edit**

To unassign one or more **Roles** from a user, you need to:

1. Open the **Users** page.
2. Select the user and, in the **Details** view, select the **Roles** sub-section in the Details View panel.
3. Select the **Roles** you want to unassign from the user and select the **Unassign** button.
4. Select **Unassign** to complete the operation.

    ![security_user_unassign_roles][security_user_unassign_roles]

## Copying Roles from Another User

:lock: Role.**Edit**

To copy the **Roles** that another user possesses and assign them to the selected user, you need to:

1. Open the **Users** page.
2. Select the user and, in the **Details** view, select the **Roles** sub-section in the Details View panel.
3. Select the **Copy** dropdown button and select **Copy Roles From Another User**.
4. Select the user from which the **Roles** will be copied to the current user.
5. Select **Copy** to complete the operation.

    !!! warning
	    There is an option to replace the current Roles with the one being copied. Use this with caution since the existing Roles will no longer be assigned to the current user.

    ![security_role_copy_from][security_role_copy_from]

## Copying User Roles to Other Users

:lock: Role.**Edit**

To copy the **Roles** that one user possesses to one or more **Users**, you need to:

1. Open the **Users** page.
2. Select the user and, in the **Details** view, select the **Roles** sub-section in the Details View panel.
3. Select the **Copy** dropdown button and select **Copy User Roles to Other Users**.
4. Select the users that will receive the **Roles** of the current user.
5. Select **Copy** to complete the operation.

    ![security_role_copy_to][security_role_copy_to]

    !!! warning
	    There is an option to replace the current Roles with the ones being copied. Use this with caution since the existing Roles will no longer be assigned to the other users.

## Creating Access Tokens for a User

:lock: User.**ShowPersonalAccessToken**

You can create any number of **Access Tokens** that will allow you to use the LightBusinessObjects assembly (`Cmf.LightBusinessObjects.dll`), which is made available to make external calls to the Critical Manufacturing REST APIs from outside the GUI. For more information, see [Light Business Objects (LBOs)](https://developer.criticalmanufacturing.com/business/lightbusinessobjects/).

:lock: User.**CreatePersonalAccessToken**

To create one or more **Access Tokens** for a user, follow these steps:

1. Open the **Users** page.
2. Select the user and, in the **Details** view, select the **Access Tokens** sub-section in the Details View panel.
3. Select the **Create** button.
4. Select a Name for the **Access Token**.
5. Select a predefined number of days for token expiration or select a custom **Expiration Date**.
6. Select an authorized Scope if there is a need to channel the usage of the **Access Token** for a specific defined scope. These Scopes can be defined through the **Roles** page and the use of the **Is OAuth Scope** flag.
7. Select **Create** to complete the operation.

    ![security_user_create_access_token_step_one][security_user_create_access_token_step_one]

8. The **Access Token** will be shown and the user can then copy the generated string for later use.

    ![security_user_create_access_token_step_two][security_user_create_access_token_step_two]

    !!! warning
        The generated string is only fully visible in this step. If it is not copied and stored in a separate location, it will not be available again.

9. Selecting **Close** will close the window and the **Access Token** will be displayed in the list of tokens.

    !!! info
        After the Access Token is created, the four last digits of the Access Token should be stored in the database and visible in the list of tokens in the Access Tokens section of the current user.

## Revoking Access Tokens for a User

:lock: User.**RevokePersonalAccessToken**

You can revoke any number of **Access Tokens** from the same section in the **Users** page. To revoke one or more **Access Tokens** for a user, follow these steps:

1. Open the **Users** page.
2. Select the user and, in the **Details** view, select the **Access Tokens** sub-section in the Details View panel.
3. Select one or more **Access Tokens** that you want to revoke and select the **Revoke** button.
4. Verify the details of the **Access Token** that you want to revoke.
5. Select **Revoke** to complete the operation and the **Access Token** will be removed.

    ![security_user_revoke_access_token][security_user_revoke_access_token]

## Adding a Public Key for a User

:lock: User.**ShowPublicKeys**

A user can add any number of **Public Keys** that allow authentication and external calls to the Critical Manufacturing REST APIs from outside the GUI.

Public keys are generated externally as part of a public/private key pair. Only the public key must be added to the user in the application. The corresponding private key must be kept secure by the client application or user, as it is used to prove ownership of the public key during authentication.

:lock: User.**AddPublicKey**

To add one or more **Public Keys** for a user, follow these steps:

1. Open the **Users** page.
2. Select the user and in the **Details** view select the **Public Keys** sub-section in the Details View panel.
3. Select the **Add** button.
4. Select a Name for the **Public Key**.
5. Input the **Public Key** string.
6. Optionally, select an **Expiration Date**.
7. Select an authorized Scope, if needed, to restrict the usage of the **Public Key** to a specific defined scope. These scopes can be defined through the **Roles** page by using the **Is OAuth Scope** flag.
8. Select **Add** to complete the operation.

    !!! info
        For user public keys, the corresponding private key length must be longer than 4096 bits for RSA and 256 bits for ECC.

## Revoking a Public Key for a User

:lock: User.**RevokePublicKey**

A user can revoke any number of **Public Keys** from the same section in the **Users** page. Revoking a public key removes it from the user account and prevents the corresponding **Private Key** from being used for authentication.

To revoke one or more **Public Keys** for a user, follow these steps:

1. Open the **Users** page.
2. Select the user and in the **Details** view select the **Public Keys** sub-section in the Details View panel.
3. Select one or more **Public Keys** that you want to revoke and select the **Revoke** button.
4. Verify the details of the **Public Key** that you want to revoke.
5. Select **Revoke** to complete the operation and the **Public Key** will be removed.

    !!! info
        After a **Public Key** is revoked, the corresponding **private key** can no longer be used to authenticate against the system.
        Revoking the **Public Key** from the application does not remove the corresponding **private key** from the user or client application.

## Managing User Workgroups

:lock: User.**ManageWorkgroups**

To manage the user **Workgroups**, follow these steps:

1. Open the **Users** page.
2. Select the user and, in the **Details** tab, select the **Workgroups** sub-section in the Details panel.
3. Add, edit, or remove User Workgroups as needed. For each **User**, you can define:

    * The **Workgroup** to which the **User** belongs.
    * The associated **Roles** within that **Workgroup**, and whether each **Workgroup/Role** combination is set as the default.

    !!! note
        - All Workgroups must have the Is Main property set to `true` and have the scope set to Workspace.
        - A User can be assigned to the same Workgroup multiple times, provided each assignment has a different Role.
        - Only one Workgroup/Role combination can be marked as the default at any time.

4. Select **Confirm** to complete the operation.

    ![manage user workgroups](../images/manage_user_workgroups.png)

## Copying User Workgroups

:lock: User.**CopyUserWorkgroups**

To copy **Workgroups** from one user to another, follow these steps:

1. Open the **Users** page.
2. Select the user and, in the **Details** view, select the **Workgroups** sub-section in the Details View panel.
3. From the **Copy** dropdown, choose one of the following options:

    * **Copy Workgroups From Another User**
    * **Copy User Workgroups To Other Users**

4. If you select **Copy Workgroups From Another User**, choose the source user (From User) whose **Workgroups** you want to copy.

    ![copy workgroups from another user](../images/copy_workgroups_from_another_user.png)

5. If you select **Copy User Workgroups To Other Users**, choose the target user (To User) to whom the **Workgroups** will be copied.

    ![copy user workgroups to other users](../images/copy_user_workgroups_to_other_users.png)

6. In both cases, you can control how the copied **Workgroups** are applied by selecting **Options** and configuring **Replace Current User Workgroups**. By default, this option is set to `false`, meaning the copied **Workgroups** are merged with the user's existing ones.

    !!! warning
	    If Replace Current User Workgroups is enabled, all Workgroups currently assigned will be removed and replaced with those from the selected user. Use this option with caution, as removed Workgroups cannot be recovered.

7. Optionally, enter a comment.
8. Select **Copy** to save and apply the changes.

## Registering Devices for a User

You can register specific devices that can be used to authenticate a **User** (a smartphone, laptop or any other device with built-in or connected authenticators) and access them in the Devices section of the **User** page. For more information on how to register a device, see [Webauthn](../../../operationguide/system-administration/security/security-portal/security-portal-strategies/security_portal_strategy_webauthn.md).

[security_user_list]: ../images/security_user_list.png
[security_user_page_details_view]: ../images/security_user_page_details_view.png
[security_user_create]: ../images/security_user_create.png
[security_user_edit]: ../images/security_user_edit.png
[security_user_delete]: ../images/security_user_delete.png
[security_user_assign_roles]: ../images/security_user_assign_roles.png
[security_user_unassign_roles]: ../images/security_user_unassign_roles.png
[security_user_create_access_token_step_one]: ../images/security_user_create_access_token_step_one.png
[security_user_create_access_token_step_two]: ../images/security_user_create_access_token_step_two.png
[security_user_revoke_access_token]: ../images/security_user_revoke_access_token.png
[security_role_copy_from]: ../images/security_role_copy_from.png
[security_role_copy_to]: ../images/security_role_copy_to.png