User Management

Overview

This document explains how to manage user accounts, security groups, and permissions on the PlantPulse platform. User management is performed from the left menu System > Users (/user/index).

User Structure

User management in PlantPulse consists of three core elements.

• User: An individual account that logs in to the platform.
• Security Group: A group that defines a user's role. Each user belongs to one security group.
• Permission: Feature-level access rights assigned to a security group. Controls access to menus, screens, and APIs.

The Three Roles

The product provides only three roles.

Role	Display name	Purpose
ADMIN	System administrator	All features. Can change other users' passwords and manage users
API	API developer	Account for external system integration
USER	General user	Basic features

There is no OPERATOR · ENGINEER · VIEWER

These names appeared in older documents, but they are not roles that exist in the product. They do not appear among the role options on the user registration screen either. The same applies to MANAGER.

Principle of least privilege: Start human accounts with USER, and grant ADMIN only to those who need administrative capability.

User Attributes

Attribute	Required	Description
User ID	O	Unique identifier used for login (letters and digits, 4–20 characters)
User name	O	Name shown on screen
Password	O	Login password (12–50 characters, see Password policy below)
Email	-	Email address for receiving notifications
Role	O	One of ADMIN / API / USER
Status	O	Active or Inactive
Description	-	Notes about the user
Created	Auto	Account creation date and time
Last login	Auto	Date and time of last login

Viewing the User List

Select the left menu System > Users to view the list of registered users.

• URL: /user/index
• You can check user ID, name, security group, status, and last login time.
• Use the search filters to quickly find a specific user.

Note: Only users in the ADMIN security group can view the user list.

Adding a User

1. Click the Add button on the user list screen.
2. Enter the required fields.
   • User ID: A unique ID consisting of letters and digits (4–20 characters)
   • User name: The name to be displayed on screen
   • Password: Must be 12–50 characters and include at least 3 of the 4 character types: uppercase letters, lowercase letters, digits, and special characters. Saving is rejected if this is not met.
   • Role: Select one of ADMIN / API / USER.
3. Enter optional fields (email, description, etc.) as needed.
4. Click the Save button.

Note: The user ID cannot be changed after creation. Set it carefully.

Editing a User

1. Click the user you want to edit in the user list.
2. Change the editable fields (name, email, security group, status, description, etc.).
3. Click the Save button.

Note: The user ID cannot be modified. To change an ID, delete the existing user and create a new one.

Deleting a User

1. Select the user to delete in the user list.
2. Click the Delete button.
3. Click Confirm in the confirmation popup.

Caution: Deleted users cannot be recovered. To block a user temporarily, use deactivation instead of deletion.

Deactivating a User

To block login without deleting a user account, use the deactivation feature.

1. On the user edit screen, change Status to Inactive.
2. Click the Save button.

A deactivated user is blocked from logging in, but their data (audit logs, configuration history, etc.) is retained. To reactivate, change the status back to Active.

---

Password Management

Passwords are changed in one place only — the left menu System > Users list.

Changing a Password (Replacing the Default Password)

This is how you change the default password right after installation.

1. Open the left menu System > Users.
2. Click the 🔑 key icon on the target user's row (tooltip: "Change password").
3. Enter the new password. If it is your own account, you must also enter the current password.
4. Save.

There are defined rules for who can change whose password.

Target	Required permission	Current password verification
Yourself	None (just be logged in)	Required — rejected if incorrect
Another user	ADMIN	Not required

If a user who is not ADMIN attempts to change another user's password, the request is rejected and an audit entry is written to the server log. Successful changes are also recorded in the form Password changed: session_user=[...], target_user=[...].

The same operation can be performed via the REST API.

POST /api/v5/user/{user_id}/password
Content-Type: application/json

{ "current_password": "<current-password>", "password": "<new-password>" }

Handling a Lost Password

• Ask an administrator: A ADMIN user resets it using the procedure above.
• Reset directly in the DB (emergency): Use this only when even the ADMIN account is locked out.

Inserting a SHA-256 value locks the account permanently

Passwords are stored as BCrypt hashes. If you insert a value using the encode(digest(..., 'sha256'), 'hex') method described in older documents, BCrypt verification at login cannot interpret that string, and no password will be able to log in. Since this procedure is used precisely when you are already locked out, you lose your last recovery option.

The table name is also USER_LOGIN, not pp_user.

Generate the BCrypt hash first, then insert that value.

# BCrypt 해시 생성 (htpasswd — apache2-utils / httpd-tools 패키지)
htpasswd -bnBC 10 "" '<new-password>' | tr -d ':\n'
# → $2y$10$... 형태의 문자열이 나옵니다

-- 비상 시에만. 위에서 만든 BCrypt 해시를 그대로 넣습니다.
UPDATE USER_LOGIN
SET PASSWORD = '<$2y$10$... paste-here>'
WHERE USER_ID = 'admin';

Immediately after inserting, verify by logging in, and once successful, change the password once more through the normal path in the UI. For passwords of infrastructure service accounts (PostgreSQL, Cassandra, MinIO, etc.), follow Changing Passwords (Credential Rotation) instead of this document — if you get the order wrong, the platform will not start.

Password Policy

What the product enforces — violating the following causes the save itself to be rejected.

Item	Value
Length	12 to 50 characters
Complexity	At least 3 of the 4 types: uppercase letters, lowercase letters, digits, special characters

What the product does not enforce — these must be managed by operational policy. The platform has no feature for the items below, so handle them through your organization's procedures if needed.

Item	Status
Forced change interval · expiry	None
Prohibiting reuse of previous passwords	None
Dictionary word blocking	None
Permanent account lockout	None — temporary blocking below is provided instead

Brute-Force Blocking (Temporary Block)

When login failures accumulate, the account is not locked; instead, requests are blocked for a set period (HTTP 429 + Retry-After). The block clears by itself over time, so there is nothing for an administrator to unlock.

Setting	Property	Default
Feature enabled	engine.session.bruteforce.enabled	Enabled
Allowed failures per IP	engine.session.bruteforce.ip_limit	30
Allowed failures per account	engine.session.bruteforce.user_limit	10
Aggregation window	engine.session.bruteforce.window.seconds	300 seconds (5 minutes)

Blocking is counted separately on two tracks: by IP and by account. In an office where many people share the same public IP, other people's failures can contribute to the IP limit (30) as well. Both blocks and failures are recorded in the audit log (LOGIN_BLOCKED / LOGIN_FAILURE).

---

Security Group Management

Default Security Groups

PlantPulse provides three default security groups.

Security group	Description	Main permissions
ADMIN	System administrator	Access to all features (user management, system settings, all menus)
OPERATOR	Operator	Access to operational features (monitoring, alarm management, data queries)
USER	General user	Access to basic features (viewing canvases, querying data)

Adding a Security Group

In addition to the default groups, you can add security groups that match your organization's roles.

1. Select the Security Management > Security Groups menu.
2. Click the Add button.
3. Enter the group ID, group name, and description.
4. Click the Save button.

Configuring Permissions

Set menu- and feature-level permissions for a security group.

1. Select a group in the Security Management > Security Groups menu.
2. Click the Permissions tab.
3. Check the Read, Write, and Delete permissions for each menu/feature.
4. Click the Save button.

Example permission configuration:

Menu	ADMIN	OPERATOR	USER
Connection management	Read/Write/Delete	Read/Write	Read
Factory management	Read/Write/Delete	Read/Write	Read
Alarm management	Read/Write/Delete	Read/Write	Read
User management	Read/Write/Delete	-	-
System settings	Read/Write/Delete	Read	-
Canvas	Read/Write/Delete	Read/Write	Read

---

Access Control

Site Access Control

In a multi-site environment, you can restrict which sites each user can access.

1. On the user edit screen, select the Site Access Rights tab.
2. Check the sites to allow access to.
3. Click the Save button.

Note: Users with no site access rights configured can access all sites.

Canvas Sharing

A canvas screen can be shared with specific users or security groups.

1. Click Share Settings on the canvas editing screen.
2. Select the sharing target.
   • Public: All users can access it.
   • Security group: Only users in the selected security group can access it.
   • Specific users: Only the selected users can access it.
3. Click the Save button.

---

Session Management

Session Timeout

The user session timeout is set to 30 minutes by default. If there is no activity for 30 minutes, the user is logged out automatically.

To change the session timeout, modify the setting in web.xml.

<!-- WEB-INF/web.xml inside the webapp (bundled in the WAR — reset on deploy, so change it in the source) -->
<session-config>
    <session-timeout>30</session-timeout> <!-- in minutes -->
</session-config>

Concurrent Login

By default, the same account can be logged in simultaneously from multiple browsers/devices. In security-sensitive environments, we recommend issuing separate accounts per user and supplementing this with network-level controls such as access IP restrictions.

---

Audit Log

Key user activities are automatically recorded in the audit log. The audit log lets you trace the history of system changes.

Activities recorded:

Activity type	Description
Login/logout	User authentication events
User management	User creation, modification, deletion, deactivation
Security group changes	Group creation, modification, deletion, permission changes
System setting changes	Changes to properties, connection information, and other settings
Data modification	Changes to master data such as factories, equipment, and points

The audit log can be viewed from the Tools > Audit Log menu and can be filtered by period, user, and activity type.

---

Bulk User Registration

To register many users at once, you can perform a batch registration using an Excel file.

Registration Procedure

1. Click the Excel Upload button in the Security Management > User Management menu.
2. Download the Excel template file.
3. Enter the user information according to the template.

Column	Required	Description	Example
user_id	O	User ID	operator01
user_name	O	User name	홍길동
password	O	Initial password	Temp1234!
email	-	Email	hong@example.com
security_group	O	Security group ID	OPERATOR
description	-	Description	생산1팀

4. Upload the completed Excel file.
5. Review the user information to be registered in the preview.
6. Click the Register button.

Note: Validation is performed at upload time. If there are errors such as duplicate IDs or missing required fields, the affected rows are highlighted so you can correct them and re-upload.

---

Best Practices

• Principle of least privilege: Grant users only the minimum permissions required for their work.
• Minimize administrator accounts: Keep the number of users in the ADMIN group to a minimum and use the OPERATOR group for routine operations.
• Periodic audits: Review the user list and permissions quarterly and deactivate unnecessary accounts.
• Handling departures: Deactivate or delete accounts immediately when an employee leaves.
• No shared accounts: Use individual accounts and avoid shared accounts.
• Password management: Instruct users to change their initial password without fail, and encourage regular password changes.
• Log monitoring: Monitor abnormal login attempts (repeated failures, access at unusual hours, etc.).

---

Common Problems

Login Failure

Symptom	Cause	Resolution
"Invalid user ID or password"	Incorrect password entered	Check the password and try again. Also check the Caps Lock state.
"This account is disabled"	Account is in Inactive state	Ask an administrator to activate the account.
"The account is locked"	Locked due to consecutive login failures	Ask an administrator to unlock it.
Login screen does not appear	Web server not running or network problem	Check the server status and network connection.

Insufficient Permissions

Symptom	Cause	Resolution
Menu is not visible	The security group has no access permission for that menu	Ask an administrator to add the permission.
"You do not have access permission" message	Insufficient API or feature permission	Check the security group's permission settings.
Data for a specific site is not shown	Site access rights not configured	Check the user's site access rights.

Session Expiry

Symptom	Cause	Resolution
Switched to the login screen while working	Session timeout (30 minutes by default)	Log in again. If the timeout is too short, adjust it in web.xml.
Logged out on another device	Forced termination by the concurrent login policy (KICK)	Check the concurrent login settings.
Repeated session-related errors	Redis cache failure	Check the Redis service status.