People, sign-in and email

People can sign in three ways. You can use more than one.

Google or Microsoft

Set when the appliance is installed, through its SSM parameters (/costcapper/oidc/…). People's groups can then map to teams and to admin rights on the Access page.

Emailed sign-in links

No identity provider needed. On Settings:

1. Email: choose an SMTP server or Amazon SES. For Fastmail, use host smtp.fastmail.com, port 587, STARTTLS on, your Fastmail address as user name and an app password. For SES, the stack needs AllowSesEmail = true and the From address must be verified in SES. Use Send me a test email to check it.
2. This appliance's address: the https:// address people open. Links are built from it.
3. Anyone at these email domains can sign in: for example epsilontg.com. Leave it empty to let in only the people you add.

Signing in only lets people in. To let everyone at a domain use every managed machine, also set Who can turn machines on; otherwise grant machines on Access.

People you add

On People, add someone by email. With email set up they sign in with a link. Without it, give them a temporary password; they choose their own the first time. You can make people admins, and turn people off, which signs them out everywhere.

The admin account

The admin account is for emergencies, for example if sign-in breaks. Keep its password safe and use your own account day to day.