Skip to main content

User management

Accounts are managed under Settings → Users (permission admin.users). The Symfony console is for starting a server and for troubleshooting.

Create an account​

  1. Settings → Users → New user.
  2. Fill in First name, Last name, Email (sign-in identifier, unique) and Password.
  3. Choose one or more Roles: they define what the user can do.
  4. Fill in the Visibility scope: what the user can see.
    • Institution: the user's organisation.
    • Followed projects: the projects whose data they see.
    • National registry access: tick only for people who must see the whole registry.
  5. Leave Active account ticked, then Create.

The user receives a welcome e-mail (sent asynchronously) containing their initial password. Ask them to change it at first sign-in under My profile → Security.

Empty scope = nothing visible

An account with no institution, no project and no national registry access sees no data, even with broad roles. Only ROLE_ADMIN bypasses partitioning. The "None — sees everything" label in the institution selector is misleading: having no institution does not give access to everything.

Passwords entered here are not checked by the system: apply the password policy yourself.

Edit an account​

Click Edit on the user's row. Every field can be changed; leave Password empty to keep it.

Permissions come only from roles. The View permissions button shows them; to change them, edit the role under Settings → Roles (see Roles and permissions) or assign another role.

Deactivate an account​

The status button on the row toggles the account between Active and Inactive. An inactive account:

  • can no longer sign in or refresh its session: it is signed out at most one hour later, when its token expires;
  • keeps its history and audit records;
  • can be reactivated at any time.

Deactivate rather than delete when someone leaves the project.

Delete an account​

Delete on the user's row, then confirm. Deletion is permanent and recorded in the audit trail. An administrator cannot delete their own account.

Passwords​

SituationMeans
The user forgot itForgot password link on the sign-in page, or sign-in by magic link
An administrator replaces itEdit, Password field
On the server, without access to the interfaceapp:reset-user-password (below); also lifts the account lockout

Five failed sign-ins lock the account for 30 minutes: see Rate limiting.

Console commands​

Always as the www-data user. Replace the values between < >; do not leave a password in the shell history (start the line with a space if HISTCONTROL=ignorespace).

# Create an account
docker exec -u www-data pch_backend php bin/console app:create-user <email> '<password>' <last_name> <first_name> --role=ROLE_ADMIN

# Replace a password
docker exec -u www-data pch_backend php bin/console app:reset-user-password <email> '<password>'
Commands not to use in production

app:create-admin and app:reset-admin-password create or reset a generic administrator account with a predictable password. They are for local development only.

The screen shows the number of active, inactive and administrator accounts, then the paginated list with a search by name or e-mail. There is no export of the user list.

Sign-ins (successful and failed, with the IP address) and account changes are recorded: Administration → Audits.

Best practices​

  • One account per person, never shared accounts.
  • Minimal role, minimal scope; national registry access is an exception to justify.
  • Review inactive accounts and administrators every quarter.
  • When a contractor's assignment ends: deactivate their accounts the same day.

See also​