> For the complete documentation index, see [llms.txt](https://docs.flopsar.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.flopsar.com/7/administrator-guide/managing-users.md).

# Managing Users

Local accounts are managed in **Access Management → Users**. Authorization is role-based: each user has exactly one role, and each role is a set of permissions.

The model — local accounts, LDAP sessions, built-in **Owner** and **Guest** roles, custom roles, banned applications, and JWT sessions — is described in [Authentication, Authorization & Identity](/7/security/authentication-authorization-and-identity.md). LDAP sign-in is configured separately; see [LDAP](/7/administrator-guide/ldap.md). Role definitions are on [Managing Roles](/7/administrator-guide/managing-roles.md).

{% hint style="info" %}
**Screenshot placeholder:** Workstation → Access Management → Users. User list with Locked badges; detail pane for role, display name, password reset, and banned applications.
{% endhint %}

## First account

A first Owner account (display name Administrator) is created when the environment is initialized. Default credentials after a fresh install are `admin` / `flopsar`. Change that password immediately.

## Local users

**Add User** creates a local account with a username and password. New local users receive **Guest** until you assign a role. You can set a display name, lock or unlock the account, reset the password, and list **banned applications** so that role permissions still apply but data from those applications is hidden.

This page lists **local** accounts only. LDAP users are authenticated against the directory on each login; Flopsar does not store a user record for them, so they never appear here. Their role comes from [group-to-role mapping](/7/administrator-guide/ldap.md#group-to-role-mapping).

Editing users requires **Edit users**. Role and permission changes take effect the next time a session token is issued (at most the 12-hour token lifetime). To cut off a user immediately, **lock** the account; already-issued tokens remain valid until they expire or the server restarts.

## Password recovery

If another operator with **Edit users** is signed in, they can reset the password from the Workstation. Otherwise, on the server host:

```shell-session
$ flopsar-server users --reset <username> <server_home>
```

This sets the password to `flopsar` and grants the user all permissions. Sign in and change the password at once.