Portal Users

1What you can allocate, and what you cannot #

You can only give a portal user the companies and branches you hold yourself . The company list shows your companies, not every company on the server, and the branch list for each comes from the same grants that decide which branches you see anywhere else in the ERP.

This is checked again when you press Save. If a request arrives with a company outside your access the whole save is refused — the pick-list is there to help, not to police.

A customer may already hold companies granted by somebody with wider access. Those are shown greyed and are left untouched when you save; you never silently revoke what you were not shown.

2Step by step #

Portal users are the customer credentials for the self-service portal.

1. Pick the customer account and create its login — username and initial credential.
2. Save with F5 ; the customer can sign in immediately.
3. Review sign-ins and pending change requests on this same page as they arrive.

3Creating a login, and the password #

• Normally you never type a password here. Create the login, allocate its access, save, then press Send invite . The customer sets their own password from that link, and nobody at your end ever knows it.
• The invite is shown once . Only a hash of it is stored, so it cannot be read back — if it is lost, issue another.
• An invite lasts 72 hours; a password reset lasts 2 hours. Issuing a new one immediately spends the old one, so there is never more than one live link.
• A login with no password cannot sign in at all. The list shows those as Invited .
• Set password is for the customer who cannot work a link — no e-mail on file, a spam filter eating it, or somebody on the telephone right now. It writes a temporary password: the customer signs in with it once, is made to choose their own, and cannot reach a single screen until they have . That is enforced by the server, not by the portal's screens, so it cannot be skipped.
• Prefer the invite where the customer can use one. Between you typing a temporary password and the customer replacing it, two people know it — and the telephone call in the middle is not a channel anybody controls. Read it out or hand it over; never e-mail it.
• Suggest one builds a four-word password that survives being read down a bad line. It is shown in the clear because you have to dictate it; only its PBKDF2 hash reaches the database, and nothing can read it back afterwards — not this screen, not a query.
• Setting a password signs the login out everywhere and spends any live invite or reset link. Two live ways into one account is one more than is safe.
• A login still holding a password you set shows a Temporary password chip. It disappears when the customer chooses their own.

4Portals, companies, branches and the customer link #

• Portals — tick the portals this login may use. One login can hold several; the landing one is where it arrives when it signs in.
• Companies are allocated per portal . The same login can be given company 2 on the Customer Portal and company 5 on E-Commerce.
• Branches sit inside an allocated company. No branch row means no branch — never "all branches".
• Customer account is what the login actually is in that company. Several people at one customer can each have their own login pointing at the same account.
• Untick a portal and its companies, branches and links go with it. That is the database doing it, not the screen.

5Locked out, disabled, signed out #

• Locked happens by itself after too many wrong passwords and clears on its own. Unlock clears it now.
• Disabled is your decision and does not clear. Disabling also signs the login out everywhere, so it stops working immediately rather than whenever its session happened to expire.
• Sign out everywhere ends every open session without changing the password — the right move when a device is lost.

6Why is a pick-list empty? #

• No companies — you are not assigned to any company. An administrator adds you in the ERP user master.

7Rules the save enforces #

• Login name must be unique across every portal login.
• An e-mail address may belong to only one login — password resets go to an address, and an ambiguous address is an account takeover.
• A branch must sit in a company allocated on the same portal; a customer link likewise.
• Only one landing portal, one default company per portal, one default branch per company.
• Every company and branch in the request must be inside your own access.

8Shortcut keys #

• F3 — new login.
• F5 — save.
• Esc — close the editor without saving.

9If something does not work #