Initial User Management Setup

The recommended order for setting up user management in a new Connectware installation.

Work through these steps in order to take a new installation from its default credentials to a secure, role-based access setup ready for your team.

Prerequisites

• Connectware is installed and running.

• You have access to the default admin account, which is created automatically during installation.

• You have access to the values.yaml file (Kubernetes) or .env file (Docker) if you plan to configure SSO or MFA.

1

Change the Default Admin Password

The default admin user is created with an initial password during installation. Change it before you do anything else.

On Docker, the default password is identical across all Connectware installations. Change it before the system goes live to prevent unauthorized access.

For instructions, see Changing User Passwords.

2

Define Your Roles

Before creating users, design the roles that reflect your organization's responsibilities. This is easier to do up front than to reorganize later.

For example:

Role name	Intended for	Suggested permissions
operator	Production staff who need to monitor data	Read access on relevant MQTT topics
engineer	Engineers who configure services and connections	Read/write access on service-related topics

Connectware includes the built-in roles connectware-admin (full access) and minimum-access (read-only Admin UI access, no data permissions). You do not need to create these — assign them directly to users.

For how to create and configure roles, see Roles. For permission syntax, see Permissions.

3

Create Your Users

With roles defined, create a user account for each person who needs access. Assign roles rather than individual permissions. This keeps your access control consistent and easy to audit.

For how to create users and assign roles, see Users.

4

Disable the Default Admin Account

Once you have at least one other user with the connectware-admin role, disable the default admin account to remove a known, predictable account name from your system.

Do not disable the default admin account until you have confirmed that at least one other user with the connectware-admin role can log in successfully. Recovering from a lockout requires direct access to the configuration files.

For instructions, see Default Admin User.

5

Choose Your Authentication Strategy

Decide how users authenticate. Your options are:

Method	Best for
Local username/password	Small teams, isolated networks, or when no corporate directory is available
Single Sign-On (SSO) via Entra ID or LDAP	Organizations with an existing identity provider, where users log in with their corporate accounts

These methods are not mutually exclusive. You can run local users alongside SSO users.

If your environment requires a second authentication factor, enable multi-factor authentication (MFA) on top of local or LDAP accounts. MFA does not replace your authentication method — it adds a one-time password step on top of it.

• To set up SSO, see Single Sign-On.

• To enable MFA, see Multi-Factor Authentication.

6

Configure Machine and Device Access

If machines or devices need to connect to Connectware over MQTT, do not create regular user accounts for them. Use one of these approaches instead:

• Client Registry — for managed device onboarding with controlled approval and certificate support. See Client Registry.

• MQTT client authentication — for simpler setups where devices authenticate with username/password or mTLS certificates. See MQTT Client Access.

What's Next

At this point, your Connectware installation has a secure user management baseline: the default credentials are changed, roles reflect your team's responsibilities, users have appropriate access, and machines connect without shared user accounts.

As your needs grow, explore these topics:

• User Session Expiration — configure how long sessions stay active before requiring re-authentication.

• Access Control for Admin UI — restrict which Admin UI features are visible to each role.

• Adding an MQTT Publish Prefix — route MQTT traffic automatically for high-throughput clients.