Profile and Password Reset

Every user manages their own account on the Profile page (/profile): name, e-mail address, password and personal API tokens. A user who has forgotten the password can set a new one with Forgot password on the login page, if the platform can send mails.

1. Opening the Profile page

Click your avatar (the circle with your initials) at the top right and choose Profile.

Permission What it grants

PROFILE_EDIT (label Edit Own Profile)

The Profile entry in the avatar menu and the Profile page itself: change your own name, e-mail address and password

API_ACCESS (label API Access)

Additionally, the API Tokens area on the Profile page

The default USER role contains PROFILE_EDIT. Without it, the avatar menu shows only Logout.

The page has up to three areas: User Data, Change Password and API Tokens.

2. User Data

Field What it does

First Name / Last Name

Your name. It is shown at the top right of the platform and used in mails, for example in the greeting of a password reset mail.

Email

Used for mails from this platform, for example a link to reset your password. If it is wrong or empty, a reset mail cannot reach you.

Username

Your login name. Read-only. Only an administrator can change it.

Click Save to keep your changes. The message is "Profile saved".

The platform does not check the format of the e-mail address here. Check it carefully, because a typo means you get no password reset mail.

3. Change Password

Use this area to change a password you still know.

Field What it does

Current Password

Your password today. It proves that you are the account owner.

New Password

The new password.

Repeat New Password

The new password again, to catch typing mistakes.

Click Change Password. The new password is used from your next login on.

Password rules

The same rules apply here, when an administrator creates a user or sets a new password for you, and when you reset a password by mail:

  • At least 10 characters.

  • At least one digit or special character. A password of letters only is refused.

Messages

Message Meaning

Current password is incorrect

The current password does not match. Nothing was changed

Password must be at least 10 characters

The new password is too short

Password must contain at least one digit or special character

The new password has only letters

Passwords do not match

The two new password fields differ

Password changed

Done

Changing your password here does not revoke your API tokens. If you think a token has leaked, revoke it yourself in the API Tokens area. A reset through Forgot password behaves differently — see section 6.

Users who log in through SSO (your company login) have no password in this platform. Their password is managed by the company login. For them, this area always answers "Current password is incorrect".

4. API Tokens

This area is shown only with the API_ACCESS permission. A personal access token lets scripts and other services use the REST API in your name. The API is described in Management REST API.

A token acts with your current roles and permissions. If an administrator removes a role from you, your tokens lose that right at once. If your account is disabled or locked, your tokens stop working.

The token list

Column Content

Name

What the token is for

Token

The first characters of the token, so you can recognise it. The full token is never shown again

Created

When the token was created

Expires

When the token stops working, or Never

Last Used

When the token was last used, or Never. Updated at most once per minute

Status

Active, Expired or Revoked

Expired and revoked tokens stay in the list. They cannot be used again.

Creating a token

  1. Click Create Token.

  2. Enter a Name — what the token is for, so you can tell your tokens apart later. It is required (at most 100 characters).

  3. Choose Expires after: 30 days, 90 days (default), 1 year or Never. A shorter time limits the damage if the token leaks, but you must create new tokens more often. Never means the token works until you revoke it.

  4. Click Create.

The dialog Your New API Token shows the token. It starts with kfp_.

  • Copy it now. Click Copy, then Done. The platform stores only a fingerprint of the token. It cannot show the token again. If you lose it, revoke it and create a new one.

  • Programs send it as: Authorization: Bearer <token>.

Revoking a token

Click Revoke in the token’s row and confirm with Revoke. The token stops working immediately. Anything still using it receives 401 Unauthorized. This cannot be undone.

An administrator with the USER_MANAGE permission can also see and revoke your tokens in the user form (Admin → User Management, edit icon). Administrators cannot create tokens for you.

5. Forgot password

On the login page, Forgot password lets users with a local password set a new one through a link sent by mail.

When the button appears

The Forgot password button is shown only when all of these are true:

  • Login with username and password is allowed. When login is set to SSO only, there is no login form and no button.

  • A mail server is set up: SMTP Host and Sender Address under Admin → Mail Server.

  • The Platform URL is set on the same page. The link in the mail is built from it.

See Mail Server and Mail Templates for the setup. If someone opens /forgot-password directly while one of these is missing, the page says: "This platform cannot send password reset mails. Please ask your administrator to set a new password for you." The administrator does this in your user account under Admin → User Management, see Setting a new password for a user.

Step 1: ask for a link

  1. Click Forgot password. The page Forgot your password? opens.

  2. Enter your Username or e-mail address.

  3. Click Send reset link.

The page always answers the same way: "If an account matches, a mail with a reset link is on its way. The link is valid for a limited time and can be used once. If nothing arrives within a few minutes, check your spam folder." It gives this answer also when no account matches, or when no mail is sent. Nobody can use the page to find out which accounts exist.

The platform looks for an account with this username. If the text contains @, it also looks for accounts with this e-mail address (upper and lower case do not matter). If several accounts share the address, each account that can reset gets its own mail.

Only these accounts get a mail:

  • The account has a local password. Users who log in through SSO have none; their password is managed by the company login.

  • The account has an e-mail address.

  • The account is neither disabled nor locked.

More rules:

  • At most one mail per account per minute. A second request within a minute sends nothing.

  • A new request replaces older links. Only the link from the newest mail works.

  • The link is valid for 60 minutes by default. The default mail text tells the user how many minutes.

Admin note: the link lifetime is the property password-reset.token-ttl (environment variable PASSWORD_RESET_TOKEN_TTL, default 60m). A longer time is more convenient for users. A shorter time gives less time to anyone who gets hold of the mail. The text of the mail is the Password Reset template under Admin → Mail Templates.

Step 2: set the new password

The link opens the page Set a new password (/reset-password?token=…). It shows the account name (Account: …).

  1. Enter New password and Repeat new password. The password rules apply.

  2. Click Set password.

On success, the page says "Your password has been changed. You can now log in with it." Click Go to login.

The link works once. If it is unknown, expired or already used, the page says "This link is invalid, has expired or has already been used. Request a new one if you still need to reset your password." and offers Request a new link. The same happens when the account was disabled or locked after the mail was sent.

6. What a completed reset changes

  • The new password works from now on.

  • All other reset links of the account stop working.

  • All of the account’s API tokens are revoked. A reset often follows a suspected break-in, so a token made with the old password must not keep working. The tokens stay in the list with the status Revoked. Create new ones on the Profile page.

The tokens are revoked only when the new password is saved. A reset that fails revokes nothing. Changing the password on the Profile page does not revoke tokens.

7. Troubleshooting

Symptom Cause and fix

No Profile entry in the avatar menu

Your role lacks PROFILE_EDIT

No API Tokens area on the Profile page

Your role lacks API_ACCESS

"Current password is incorrect" although you are sure

Check upper/lower case and the keyboard layout. SSO users have no local password and always get this message

Lost a new token

It cannot be shown again. Revoke it and create a new one

Programs get 401 Unauthorized

The token is revoked or expired, or your account is disabled or locked. A completed password reset also revokes all tokens

No Forgot password button on the login page

Mail server, sender address or Platform URL is missing, or login is set to SSO only. Ask an administrator

No reset mail arrives

Check the spam folder. Check that your account has the right e-mail address (Profile → Email). SSO accounts, accounts without e-mail and disabled or locked accounts get no mail. Wait one minute between requests

An older reset link does not work

Only the newest link works, each link works once, and it expires after 60 minutes by default. Request a new one

The link in the mail opens the wrong site

The Platform URL under Admin → Mail Server is wrong

All API tokens show Revoked after a reset

Expected. Create new tokens

Related