User Management¶

This guide covers creating and managing users in the SPSA Portal.

---

User Administration¶

All user management is done through the SPSA Portal web interface:

1. Log in as administrator
2. Click your username > Settings
3. Select Users

---

Create User¶

New User¶

1. Go to Users
2. Click New User
3. Configure account settings

Account Settings¶

Field	Required	Description
Username	Yes	Login name for SPSA Portal
Password	Yes	Initial password
Confirm password	Yes	Must match password

Profile Settings¶

Field	Description
Full name	Display name for identification
Email address	Contact email address
Organization	Company or department
Role	Job title or function

Profile fields are optional but useful for identifying users.

Account Restrictions¶

Control when and how users can access SPSA:

Setting	Description
Login disabled	Temporarily disable the account
Password expired	Force password change on next login
Allow access after time	Time-based access start (e.g., 08:00)
Block access after time	Time-based access end (e.g., 17:00)
Enable after date	Account activates on date
Disable after date	Account expires on date
Timezone	User's timezone for time restrictions

Time-Based Access Example:

To allow a contractor access only during business hours:

Setting	Value
Allow access after time	08:00
Block access after time	17:00
Disable after date	Project end date

1. Click Save

---

User Permissions¶

System Permissions¶

Permission	Description
Administer system	Full administrative access
Create new users	Can create user accounts
Create new user groups	Can create groups
Create new connections	Can create connections
Create new connection groups	Can organize connections
Change own password	Can change own password

Recommended Permission Sets¶

Standard User:

• [x] Change own password
• [ ] All other permissions disabled

Help Desk / Support:

• [x] Change own password
• [x] Create new users
• [ ] Administer system (leave disabled)

Full Administrator:

• [x] All permissions enabled

---

Connection Permissions¶

Assign Connections¶

1. Edit the user
2. Scroll to Connections section
3. View tabs:
4. Current Connections - Currently assigned
5. All Connections - All available connections
6. Check boxes next to connections to grant access
7. Click Save

Permission Levels¶

When assigning connections, you can set permission levels:

Permission	Description
Read	Can use the connection (default)
Update	Can modify connection settings
Delete	Can remove the connection
Administer	Full control over the connection

---

User Groups¶

Benefits of Groups¶

• Assign connections to groups instead of individual users
• Easier permission management at scale
• Logical organization (by department, role, or project)

Create Group¶

1. Go to Groups
2. Click New Group
3. Configure:
4. Group name
5. Description (optional)
6. Click Save

Assign Users to Group¶

1. Edit the group
2. Under Members, add users
3. Under Connections, assign connections
4. Click Save

Group-Based Permissions¶

Users inherit connection access from their group memberships. This allows:

• Add user to "IT Administrators" group → User gets access to all admin connections
• Remove user from group → Access is revoked

---

Password Management¶

Reset User Password¶

1. Go to Users
2. Click on the user to edit
3. Enter new password in Password field
4. Confirm in Confirm password field
5. Click Save

Force Password Change¶

To require a user to change their password on next login:

1. Edit the user
2. Enable Password expired
3. Save

Password Best Practices¶

• Use strong, unique passwords
• Do not reuse passwords from other systems
• Change default passwords immediately
• Avoid using characters Z and Y (keyboard layout issues)

---

Disable/Delete Users¶

Disable User (Temporary)¶

To temporarily block access:

1. Edit the user
2. Enable Login disabled
3. Save

The user cannot log in but the account is preserved.

Delete User (Permanent)¶

1. Go to Users
2. Select the user
3. Click Delete
4. Confirm deletion

---

Multi-Factor Authentication¶

TOTP MFA¶

SPSA requires TOTP-based MFA for all users. On first login:

1. User enters username and password
2. QR code is displayed for authenticator app enrollment
3. User scans QR code with:
4. Google Authenticator
5. Microsoft Authenticator
6. Other TOTP-compatible apps
7. User enters 6-digit code from app
8. MFA is activated for the account

MFA for Every Login¶

After initial setup, users must provide:

1. Username and password
2. Current 6-digit TOTP code

This applies to all users including administrators.

---

Audit & Compliance¶

Session History¶

View user activity in History:

• Session start and end times
• Connection used
• Duration
• Remote host accessed

User Access Review¶

Regularly review:

• [ ] Active user accounts
• [ ] Connection assignments
• [ ] Group memberships
• [ ] Last login times

Remove unused accounts promptly.

---

Best Practices¶

Account Management¶

• Create individual accounts per user (no shared accounts)
• Use descriptive usernames (e.g., firstname.lastname)
• Set password expiration for sensitive environments
• Use groups for easier permission management
• Review access regularly (monthly recommended)

Security¶

• Follow least privilege principle
• Use time-based restrictions for contractors/temporary access
• Disable accounts instead of deleting (for audit trail)
• Remove access promptly when users leave

Documentation¶

• Record who has access to what
• Document group membership criteria
• Keep track of temporary access grants