Users, roles and SSO

The owner account is created by the setup wizard and owns the installation. Every other account is created here, given a role, and - on Team and above - optionally given a different role inside a particular namespace.

The roles

Creating an account

An email address, which is also the user name, and a role. Portiger generates a ten-character temporary password and shows it once, with the reminder that it will not be shown again - copy it and pass it on securely, or, where the panel has a working mail path, send it by email from the same dialog. The person sets a permanent password at their first sign-in, and until they do, their row offers to send the temporary one again.

Access per namespace

On Team and above, a person can be given No access, Viewer or DevOps in a particular namespace. It replaces their role there, so a deployer set to viewer in one namespace is a viewer in it. An owner or an administrator reaches every namespace, so there is nothing to set for them; on an installation with one namespace there is nothing to set at all. Below Team, a person's role applies everywhere.

Signing in with SSO

Sign-in can be delegated to a Git account: GitHub, GitLab, Gitea or Bitbucket. A provider is registered with its kind, a name, the OAuth client ID and secret, the scopes, and - for a self-hosted GitLab or Gitea - its base URL. The redirect URI is fixed and shown for you to copy: register that exact URL as the callback in the OAuth app. A provider can be disabled without being deleted.

How many of each

The Users page counts the seats in use against the plan, and a create past the limit is refused with those same numbers.