Users – creating and maintaining user accounts¶
This chapter describes the user accounts of nexxcite: how they are created and edited, how an account is locked, how password expiry works for a single user, what the user profile is for and how an administrator resets the two-factor authentication of a user.
It is intended for administrators who maintain the accounts of an installation. The rules that apply to all users alike – password policy, sign-in protection, session lifetime – are described in Sign-in and sessions.
1. Users at a glance¶
A user is an account that can sign in to nexxcite – in a browser, or through the REST API by way of an API access. What a user may see and do is decided by the roles assigned to them, see Roles and permissions.
Users are managed in the Admin Studio under Access → Users. The user editor has three tabs:
| Tab | Content |
|---|---|
| "General" | User name, "Password", "Locked", "Password expires", "Password expires at", "Roles" and – read-only – "Effective Roles" |
| "Ext Assignments" | The links of this account to external sign-in providers, see Authentication providers |
| "Profile" | The user's profile record: name, mail address and further personal data |
The permissions around users:
| Permission | Allows |
|---|---|
| "Open User Manager" | Seeing the list of users (Admin Studio → Access → Users) |
| "Add User" | Creating users, also by cloning |
| "Edit User" | Changing users, including their roles |
| "Reset User Password" | Setting the password of a user – in the user editor and with the action command Create Or Update User |
| "Delete User" | Deleting users |
| "Reset Two-Factor Authentication of a User" | The button "Reset 2FA", see section 8 |
By default, all of them are granted only to system administrators.
The same permissions apply when an action creates, changes or deletes users, see section 10.
Users are not part of sketches¶
A user account is not a design change. Saving or deleting a user in the Admin Studio therefore takes effect immediately – even while a sketch is open. The account, its password and its role assignments are not collected in the sketch and are not transported to another installation with a sketch file.
2. The first administrator¶
When nexxcite starts for the first time on an empty database, it creates:
| What | Name | Content |
|---|---|---|
| User | nxadmin |
Assigned to the role "Administrator" |
| Role | "Administrator" | The permission "System Developer" – that is, every permission |
| Role | "Default User" | No permissions – a starting point for ordinary users |
The initial password of nxadmin is written to the console output of the application during this
first start.
For administrators
- Change the initial password right after the first sign-in, or create personal administrator
accounts and lock
nxadmin(section 5). - Do not delete
nxadmin. If no account carrying this special marker exists when nexxcite starts, nexxcite creates it again – with the initial password. The same applies to the two roles above. Locking the account is the safe way to retire it.
3. Creating and editing a user¶
- Open Admin Studio → Access → Users and add a new user.
- Enter the user name in the header of the editor. It is the name the user signs in with. Unlike other definitions, a user has no separate display name – the user name is shown everywhere.
- Enter a password, or leave the field empty for a user who signs in only through an external provider.
- Select the roles. "Effective Roles" shows all roles the user actually gets, including the roles that the assigned roles include.
- Fill in the profile in the tab "Profile" – above all the mail address, see section 7.
- Save.
Setting a password¶
- The password field shows
********for an existing user whose password is not being changed. Typing a new value replaces the password when you save. - Setting a password needs the permission "Reset User Password" – also for a new user. Without it, the field is read-only; you can still create and edit users, for example users who sign in through an external provider.
- The new password must meet the password policy of the installation (see Sign-in and sessions, section 3). If it does not, the dialog "Password not accepted" lists every rule that is broken, and nothing is saved.
- Setting a new password ends all other sessions of this user: open browser tabs at the latest after the interval "Re-check the user every (minutes)" (default 30 minutes).
- The editor does not show the current password and cannot reveal it.
Example: The password policy is left at its defaults. The password summer is rejected with three
messages (digit, upper case letter and special character missing). Summer-2026 is accepted.
What the user name is used for¶
| Where | Use |
|---|---|
| Sign-in page | The field "Username" |
| "Forgot password?" | The user enters their user name; the link goes to the mail address of their profile |
| Lists, history, "Created by" | The user name is shown as the name of the user |
4. Roles of a user¶
The field "Roles" holds the roles that are assigned directly. A role can include other roles; the user then gets those as well. "Effective Roles" shows the complete result and cannot be edited.
What the user may do with these roles shows the "Permission Overview": select the user in the list and click "Permission Overview" in the toolbar. It lists every permission with its result and the role that decides it, and the access to the records of every entity. The button requires "Open Role Manager". Details in Roles and permissions, section 10.
Changing the roles of a user is saved immediately like the rest of the account. When the change reaches a user who is already working is described in Roles and permissions, section 9.
5. Locking an account¶
nexxcite knows two kinds of lock. They are independent of each other.
| Permanent lock | Temporary lock | |
|---|---|---|
| Set by | An administrator: switch "Locked" in the user editor | nexxcite, after too many wrong passwords or codes in a row |
| Ends | When an administrator switches it off | On its own, after "Lock account for (minutes)" (default 15) |
| Visible in the user editor | Yes | No |
| Sign-in page | Leads to the page "This account is locked" | Leads to the page "This account is locked" |
| REST API | Tokens are refused, existing tokens stop working immediately | Not affected |
The temporary lock and its settings are described in Sign-in and sessions, section 4.
Locking ends running sessions¶
A user who is signed in when you lock their account is signed out as well: their browser sessions end at the latest after the re-check interval (default 30 minutes, see Sign-in and sessions, section 6), their API tokens stop working immediately. To shut a user out at once:
- Switch "Locked" on and save.
- Open Admin Studio → Access → Authenticated Users, select the user and click "User Sessions".
- Click "Sign out user".
Step 1 alone is enough when a delay of up to the re-check interval is acceptable. Steps 2 and 3 end the browser sessions right away.
What the user sees¶
The page "This account is locked" always explains the lock with too many failed sign-in attempts and names the duration of the temporary lock – also for an account that an administrator has locked. The page deliberately does not say which account is affected.
6. Password expiry for a user¶
Whether the password of a user expires is decided per user. The global setting "Password expires after (days)" only states the period (see Sign-in and sessions, section 3).
| Field | Meaning |
|---|---|
| "Password expires" | On: the password of this user expires. Off: it never expires, whatever else is set. |
| "Password expires at" | The moment the current password expires. Empty means it has not expired yet and does not expire until a period is set by a password change. Only editable while the switch is on. |
When the moment has passed, the next sign-in with the correct password leads to the page "Change your password" with the notice "Your password has expired. Please set a new one to continue." Nothing else can be reached until the new password is set.
After the user has set a new password, nexxcite moves "Password expires at" forward:
- by "Password expires after (days)", if that value is greater than 0,
- otherwise the field is cleared – the password then stays valid until an administrator sets a new moment.
Example: "Password expires after (days)" is 90. On 1 March you switch on "Password expires" for a user and set "Password expires at" to 1 March, 8:00. When the user signs in that afternoon, they have to choose a new password. Afterwards the field says 30 May. On 30 May they are asked again.
Making a user change their password at the next sign-in¶
Switch "Password expires" on and set "Password expires at" to a moment in the past. This is the usual way after you have set an initial password for a new user.
A password that you set in the user editor does not move the expiry moment. Only a change by the user themselves (change, reset or expired password) does.
7. The user profile¶
Personal data of a user – name, mail address, phone number and so on – is not part of the account but of a profile record. The profile belongs to a special entity that nexxcite creates on the first start ("UserProfile"). Its fields can be extended like those of any other entity.
| Where | What it shows |
|---|---|
| User editor, tab "Profile" | The profile record of the user in the default form of the profile entity |
| User menu, "My profile" | The user's own profile. Only offered when a form is selected under Admin Studio → System → Settings → "Profile form". |
The mail address in the profile is the only mail address nexxcite knows for a user. It is used for
- password reset links,
- the notice nexxcite sends after a user has changed their own password.
A user without a mail address in their profile cannot reset their password themselves.
The picture on the user menu button¶
The user menu button in the top app bar shows a placeholder icon. It shows the user's own picture instead when the profile entity provides one:
- Add a text field to the user profile entity, long enough for the result of an image expression, and
give it the flag
SpecialField.UserAvatar(see Entities and fields, section 9). - Create an image expression that returns the picture – for example the uploaded picture of the user or their Microsoft Entra ID profile picture.
- Fill the field with the result of that expression. The usual way is a calculation rule that writes the expression into the field, with the field setting "Run Business Rules on load" switched on for a field that triggers the rule (the avatar field itself is possible). The rule then runs when the profile record of the user is opened for the menu.
The menu button reads the value of the field after the calculation rules of the profile record have run. A value that is not the result of an image expression is not shown.
The placeholder stays when no field carries the flag, when the field of a user is empty, or when the value is not a picture or icon.
The picture is cached per user. A new save of the profile record shows at the next page load. A picture that changes only outside nexxcite – a new Entra ID profile picture, for example – can take up to about 15 minutes to appear.
8. Resetting the two-factor authentication of a user¶
When the installation uses two-factor authentication (see Sign-in and sessions, section 5), users set up an authenticator app themselves. An administrator cannot set it up for them. When a user has lost access to their app and to their recovery codes, an administrator removes the second factor:
- Open Admin Studio → Access → Users and select the user.
- Click "Reset 2FA" in the toolbar and confirm.
The authenticator app and all recovery codes of the user are removed. Their next sign-in asks for the password only. If two-factor authentication is "Enforced", the user is taken to the setup of a new app directly after it.
| Situation | What happens |
|---|---|
| No user selected | Message "Select the user whose second factor should be reset first." |
| The user has not set up an app | Message "… has not set up an authenticator app, so there is nothing to reset." |
| Two-factor authentication is "Disabled" | The button is not shown. |
The button requires the permission "Reset Two-Factor Authentication of a User". Whoever has it can turn any account back into one that a password alone opens – grant it with care.
A cloned user never takes over the second factor of the original.
9. Deleting a user¶
A user is deleted in Admin Studio → Access → Users. Note:
- The profile record of the user is not deleted with the account.
- Like saving, deleting a user takes effect immediately, also while a sketch is open. The user can no longer sign in.
- If you only want to keep a person out, lock the account instead (section 5). Locking can be undone.
10. Managing users with actions¶
Accounts can also be created, changed and deleted by an action – for example from an onboarding form, an import or a scheduled synchronisation with another system. Two commands in the toolbar menu "Data" of the action editor do this:
| Command | Does |
|---|---|
| Create Or Update User | Creates a user or changes one: user name, password, roles, profile record, lock, password expiry and links to authentication providers |
| Delete User | Deletes a user and their role assignments and removes the link of their profile record |
An action runs with the permissions of the user it runs for. The commands therefore check the same permissions as the user editor and user manager: "Add User", "Edit User", "Delete User" and – when a password is set – "Reset User Password". Building such an action needs none of them.
Like saving in the user editor, the commands take effect immediately, also while a sketch is open.
11. Limitations¶
- Locking an account ends the browser sessions that are already open only at their next re-check, up to the re-check interval later (section 5).
- The page shown for a locked account always speaks of failed sign-in attempts, also when an administrator locked the account.
- A temporary lock cannot be lifted early by an administrator. It ends on its own.
- The user editor does not show whether a user has set up two-factor authentication. "Reset 2FA" tells you when there is nothing to reset.
- Mail addresses are taken from the profile only. A user without a profile record, or with an invalid address in it, gets no mails from nexxcite.
12. Frequently asked questions¶
Can I see the password of a user? No. Passwords are stored in a form that cannot be turned back into the password. You can only set a new one.
A user has forgotten their password. What can I do? If the password reset is set up, the user requests a link with "Forgot password?" on the sign-in page. Otherwise set a new password in the user editor and – recommended – mark it as expired so that the user chooses their own (section 6).
I locked a user, but they are still working. Why? Locking ends open browser sessions only at their next re-check, which can take up to the re-check interval. To end them right away, sign the user out as described in section 5.
Does a new user need a password? No. A user who signs in only through an external provider needs no password in nexxcite. They then cannot use the internal sign-in, and the password reset tells them by mail which provider they sign in with.
Do user accounts move to another installation with a sketch? No. Users, their passwords and role assignments are saved directly and are never part of a sketch.
Can the AI assistant create or change users? No. Users, roles, credentials, API access and authentication providers are not accessible to the AI assistant, neither for reading nor for writing. The assistant can, however, build an action that uses the commands of section 10; whoever runs the action needs the permissions described there.