Managing User Accounts

The account actions are on the Account actions and Account cards of the user's page. You open the page by pressing the user's name on the Administration → Users & roles screen. Every action here is written to the audit log.

Verifying an e-mail address by hand

Anyone can open an account with somebody else's e-mail address. Verify the address only after you have confirmed by phone or through institutional correspondence that the person really uses that mailbox. The safer way is to give the person a one-time password link. Whoever opens the link has proved the address, and the address is verified automatically.

1. On the Verify e-mail manually row, press Confirm.
2. Read the warning in the window and press Confirmed — verify.

This row appears only on accounts whose e-mail address is not verified. The status of a verified account becomes Active.

Changing the name and e-mail address

1. On the Edit name and e-mail row, press Edit.
2. Change the Full name or E-mail address field.
3. Press Save.
4. If you changed the e-mail address, press Change the e-mail address in the window that opens.

From then on, the person signs in with the new address. Until the new address is verified, the account counts as unverified, and actions such as submitting are closed to it. A verification link goes to the new address and a notice to the old one. Password links sent to the old address stop working. If another account was opened with the new address, nothing is changed.

You cannot change your own address on this screen. You change your own address on the My profile page. How a person changes their own address is described in Changing Your E-mail Address.

One-time password link

You pass this link on yourself to a person who forgot their password, or in an installation without e-mail sending.

1. On the One-time password link row, press Create link.
2. Copy the link in the Password reset link window.
3. Pass the link only to the person themselves, through a secure channel.

The link is valid for the time shown in the window, 60 minutes by default, and works only once. When the person sets their password with the link, their e-mail address counts as verified too.

Account lock

In a default installation, an account is locked for 15 minutes after 5 failed attempts in a row. The lock appears with its end time on the Locked until row of the Account card and lifts by itself at that time. To lift the lock earlier, press Unlock on the same row.

The locked-out person is told by e-mail. A security alert goes to the system administrators too. The alert is explained in Operations Alerts.

Disabling an account

1. On the Account actions card, press Disable account.
2. In the window that opens, press Disable account again.

The person cannot sign in, and their open sessions are closed at once. No data is deleted. You open the account again with the Enable account button in the same place.

The person's editorial, reviewing and production roles stay in place, and the person continues the work once the account is open again. While the account is closed, the person gets no reminders. Notifications meant for the person go to the team of the same work. The production coordinators receive the production notifications, and the journal's editors-in-chief receive decision recommendations. On the editorial and production screens the Account closed label appears next to the person's name. If the account stays closed for long, give the person's work to someone else.

If you suspect that an account has been taken over, disable it first. Once you have confirmed the person's identity, enable the account and give the person a one-time password link.

Limits on your own account

You cannot disable or anonymise your own account. On this screen you cannot change your own name and e-mail address, create a password link for yourself or reset your own two-factor authentication. The buttons for these actions do not appear on your own page.

Resetting two-factor authentication is described in Resetting Two-Factor Authentication, and anonymising an account in Anonymising an Account.