Members and accounts

Who works in a team is decided by its admins. The member list is on the Teams page, on the People tab; the quickest way there is Members in the user menu. Only team admins see that item, and everything on the tab applies to the current team only. What each role may do is described in Teams and roles.

Members are managed in the browser. On the server, accounts can also be created, deactivated and activated from the command line, see Accounts on the server; adding them to a team is still done on the People tab or in System Settings.

zoom_inEnlarge

Members

The Members card shows each person's role and what you can do with them. Notes under a name say you, from the directory (the member comes from single sign-on), account managed outside this team, or that the member is suspended or their account deactivated.

zoom_inEnlarge

To change a role, pick another one in the list: it is saved at once. The other actions are in the More menu next to each member:

The last active team admin cannot be demoted, suspended, removed or deactivated: a team is never left without an administrator. Members marked from the directory get their role from single sign-on groups, so here they can only be suspended.

Add a person

1. 01
   Open Members in the user menu

   The People tab of the current team opens. If you belong to several teams, switch to the right one first.

2. 02
   Fill in Add a person

   Enter the account name and pick a Role: Team admin, Operator, Vulnerability manager or Reader. Reader is preselected.

3. 03
   Click Add

   An existing account joins at once; the toast says "<name> was added as <role>." For a name without an account, ScanSuite asks whether to create it: click Create account and a one-use password link is shown.

zoom_inEnlarge

Check: the person appears in the Members list with the role you picked. An existing account sees the team on its next request; there is nothing to send. A deactivated account cannot be added, and a person who is already a member keeps their row: change their role in the list instead.

Account names are 2 to 100 letters, digits, dots, hyphens, underscores or @, starting with a letter or a digit.

zoom_inEnlarge

The password link

The owner of a new account sets its password. ScanSuite shows a link once: send it to the person, who opens it, chooses a password and can then sign in. The link works once and for 72 hours.

zoom_inEnlarge

The link opens Set your password: the person enters a new password twice and clicks Set password, then signs in. An expired, used or cancelled link says so; ask the team admin for a new one. A password needs at least 8 characters with an upper-case letter, a lower-case letter, a digit and a special character.

Reset a password

In the More menu choose Reset password and confirm. The current password stops working at once, the member's sessions end, and ScanSuite shows a new link to set a password, handed over like the first one. An earlier unused link stops working.

zoom_inEnlarge

Whose accounts you can change

One account can belong to several teams. So that the admin of one team cannot take over someone else's account, Reset password and Deactivate account are offered only for accounts that:

• are active and belong to your team only;
• sign in with a password, are not linked to a single sign-on provider and are not managed by the directory;
• are neither a system administrator's nor your own.

For everyone else you can change the role, suspend them or remove them from the team. Everyone manages their own account on My account.

My account

Everyone manages their own account on My account in the user menu:

zoom_inEnlarge

Repository access

Both values are yours alone: stored encrypted, never shown again, and nobody else can read or use them, administrators included. Once saved, each shows the date and, for the key, its SHA256 fingerprint, with a Remove button.

How the team key, your own key and the Git service fit together is described in Git repository authentication.

Interface language

In Preferences, pick the Interface language (English or Русский) and click Save. The page reloads in that language. The choice is kept in this browser, so it survives signing out; another browser starts with the default again. Without a choice of your own, ScanSuite uses the default a system administrator set in System Settings (Shared services → Interface language), and English when none is set. This card is the only place to change your language.

The language of AI-written finding descriptions is a team setting, not a personal one, see Teams and roles.

Accounts on the server

Accounts can also be managed from the command line on the server, for example to create one before anyone opens ScanSuite. <USER_NAME> is the account name, following the rules above:

cd /opt/scansuite
docker compose exec web python -m authentication.accounts create <USER_NAME>
docker compose exec web python -m authentication.accounts deactivate <USER_NAME>
docker compose exec web python -m authentication.accounts activate <USER_NAME>

create asks for the password twice in the terminal and creates an account that belongs to no team yet: add it to a team on the People tab, or make it a team's administrator in System Settings. deactivate disables the account and ends all its sessions; activate lifts that.