Back to Home

29. Users & Sign-up

Your instance is public at https://<your-subdomain>.bpmncentral.com, so who may get an account is a setting you control. Every instance starts closed: nobody can register, and you create accounts yourself. Open it up only as far as you need. All of this lives on System Settings → Who can sign up and User Management.

The three sign-up modes

Mode Public sign-up page How people get in Needs email
Admin creates users (default) hidden You create the account with a temporary password and hand it over in person or through a channel you trust. The person must choose a new password at first sign-in. no
Invite only hidden You type an email address; the person receives a link, sets their own name and password. Links are valid for 7 days and can be revoked. yes
Self sign-up for allowed domains visible Anyone with an email address on your allowed domains (for example acme.com) can register after a captcha and an emailed verification code. yes

Whatever the mode, a new account has no role and sees nothing until you grant one on User-Role Management. That is deliberate: getting in and getting access are two separate decisions.

Creating a user (Admin creates users)

  1. User Management → New user. Enter the name, the email and a temporary password (at least 8 characters).
  2. Give the person the password out of band. It is shown once and never emailed.
  3. They sign in, are asked to set a new password immediately, then wait for you to assign a role.

The page is active only in this mode. In the other two modes it shows a notice and a link back to Settings, so each mode has exactly one way to add people.

Inviting a user (Invite only)

  1. Switch the mode to Invite only and make sure an email source works (see below).
  2. User Management → Invite user, type the address, send. The page lists pending invitations with their expiry; Revoke kills a link, inviting the same address again replaces the old link.
  3. The person opens the link, chooses a password, and can sign in at once. No temporary password changes hands.

Opening self sign-up (allowed domains)

  1. Choose Self sign-up for allowed domains, list your domains comma-separated (acme.com, acme.co.uk). The mode cannot be saved with an empty list or without a working email source, because the domain check is only worth something when the address is verified by a code.
  2. A Sign Up link appears on the login page. Registrations from other domains, wrong captcha answers, and sign-ups over the daily verification-email cap (default 50) are refused before any email is sent, so a flood of attempts cannot drain your email quota.
  3. If your email source stops working, the sign-up page goes dark automatically until it is fixed.

Which email source sends these messages

System Settings → Email Configuration → Email Provider:

  • BPMN Central (included) — the default on every hosted instance. Sign-in codes, invitations, password resets and workflow reminders are sent by BPMN Central on your behalf, from a BPMN Central address with your sender name and your instance owner as Reply-To. Nothing to configure; fair-use limits apply per instance.
  • SMTP / Resend / SendGrid — your own provider and your own sender address. Enter the credentials, press Send test email, and every message above goes through it instead.
  • None — no email at all. Only Admin creates users works then, and password recovery is the admin's Reset User Password button.

When someone leaves

Disable or delete the account on User Management and revoke any pending invitation for their address. The rest of the offboarding list is in the previous chapter.

⬅ Previous: 28. Security & Offboarding