Access

Under Access you decide who may sign in and what each person may do. A person gets one or more roles, and the role decides which areas they see and which actions they may take. The area also holds the sign-in log and the settings for the sign-in through Shopware.

Where to find it

Help and administration > Access. The address is /s/<shop>/access. The page has up to four tabs: People, Roles, Sign-in log and Shopware sign-in. You only see the tabs your role allows.

Your own account is a separate page: Help and administration > My account. See Signing in.

What you need

Some rules always apply:

• Another person changes your own account and your own roles. You cannot do that yourself.
• You can only grant permissions you have yourself.
• Only owners create and change owner accounts.

Which kinds of accounts are there?

An account marked Owner has every permission, regardless of roles. It is meant as emergency access.

How do I create an account for a team member?

1. Open Help and administration > Access and click New account.
2. Enter a Username: 3 to 60 characters, only lowercase letters, digits and . _ - @.
3. Enter the Display name. Email (info only) is optional. Credentials are never sent by email.
4. Choose the Role and under Applies to the shops it applies to: only this shop, all shops of this customer, or all shops.
5. Choose the Sign-in page: Workplace (Shopware) or Management.
6. Leave Require two-factor authentication ticked unless there is a good reason not to.
7. Click Create.
8. The page Activation code appears. Hand the code over only in person, by phone or in Teams. Not by email, not as a link. It works once, is valid for 24 hours and can't be shown again.
9. Click Done. The person activates the account as described under Signing in.

Note: People who sign in through Shopware need no account from you. They appear in the list after their first sign-in. If they show awaiting role, open the account and assign a role.

How do I create an external account?

1. Click New external account.
2. Fill in username, display name, role and scope as above.
3. Set Valid until. External accounts need an end date and are valid for one year at most.
4. Under Allowed modules tick at least one module. External users see only these modules, never access management.
5. Click Create and hand over the activation code.
6. Ask a second person with Approve external accounts to approve the account. Until then it shows awaiting approval and does not work.

How do I approve an external account?

1. Open Help and administration > Access. Accounts that wait are listed under Awaiting approval.
2. Click the account to check it: person, role, modules and end date.
3. Under Approval click Approve.

The approval must come from a person other than the one who created, last extended or reset the account.

How do I create a read-only account?

1. Click New read-only account.
2. Fill in the form as above. Valid until (optional) may stay empty.
3. Click Create and hand over the activation code.

How do I change what a person may do?

1. Open Help and administration > Access and click the person.
2. Under Roles you see each role and the shops it applies to.
3. To add a role, choose Role and Applies to, then click Assign role.
4. To take a role away, click Remove, tick Yes, I am sure and confirm. The person loses the related rights at once.
5. Under Details you change the display name, the end date, the sign-in page, the note and, for external accounts, the modules. Click Save.

What do the states mean?

How do I help someone who cannot sign in?

Open the person's account and go to Security. It shows whether a password is set and which second factors exist.

Every action under Interventions takes effect at once. Tick Yes, I am sure and confirm.

Note: For a Shopware account, password and two-factor authentication are managed in Shopware. Here you can only end the sessions, block the account or change its roles.

How do I create or change a role?

1. Open the tab Roles. Roles marked system can't be changed.
2. Click New role for an empty role, or pick one under New role from a template. A template pre-fills the permissions. You can change everything before saving.
3. Enter a Role name and a Description.
4. Under For all modules tick what the role may do everywhere: View (all modules), Edit (all modules), Approve (all modules) or Export (all modules). This also applies to modules added later.
5. Under Permissions by module click a module to see its permissions and tick them one by one. Hover a permission to read what it allows. Entire module (excluding approve and export) allows everything in that module; approve and export must be picked one by one.
6. Click Save. Changes take effect at once for everyone with this role.

Permissions marked sensitive expose money, people or bulk data. Every use is logged. Grant them deliberately.

To delete a role, open it and click Delete role. This only works when nobody has the role any more.

Which role templates are there?

How do I read the sign-in log?

1. Open the tab Sign-in log.
2. Warnings: unusual volume lists cases where unusually much was fetched. Click Mark as seen when you have looked at a warning. It stays in the log.
3. Sign-ins and failures lists who signed in when and what was refused, with the result ok or rejected. Older entries loads more.
4. Clear IP lock: too many failed attempts from one address block that address for everyone behind it. Enter the IP address and click Clear lock. Only the admin of all shops may do this.

How do I set up the sign-in through Shopware?

This needs the sign-in plugin in the shop. See Onboarding wizard.

1. Open the tab Shopware sign-in.
2. Tick Enable sign-in through Shopware.
3. Tick Generate a new secret and click Save. The New shared secret is shown only once. Enter it in this shop's plugin configuration. Don't send it by email.
4. Optional: enter the Shopware administration URL. If empty, plinth uses the public shop URL plus /admin.
5. Decide on Accept only Shopware sign-ins with two-factor authentication.
6. Choose the Role for new Shopware accounts, or None: wait until someone assigns a role.
7. Click Save.

Warning: Generating a new secret makes the current one stop working at once. Sign-in through Shopware is down until the new one is entered in the plugin.

Under Fallback you can tick Allow sign-in with Shopware username and password. The password then passes through plinth, and Shopware's two-factor authentication doesn't apply. Turn it on only while the plugin is missing.

Common errors and fixes

See also

• Signing in
• Onboarding wizard
• Audit log
• Glossary