10.4. Users

Administration → Users

In the Users menu of the administration site administrators can:

  • search for users

  • change settings for individual users

  • suspend and delete users

  • make users site staff or administrators

  • check the administrator notification settings

  • add and update users manually or by CSV

  • view reports

In the Users menu of the administration institution administrators can:

  • search for users

  • change settings for individual users

  • suspend and delete users

  • check the administrator notification settings for their institution’s administrators

  • add and update users manually or by CSV

  • view reports

10.4.2. User account settings

Administration → Users → User search → Click on a username

On the Account settings page of a user in the administration area, you can perform a number of actions to manage the user’s account. However, you cannot change personal information about this user, e.g. name or email, from this page. This can only be done in the Content area of the user’s account or via the Add users by CSV page.

User account settings

Overview of the user account settings page

  1. Log in as this user.

  2. Suspend or delete this user.

  3. Change site account settings.

  4. Change institution settings.

10.4.2.1. Log in as

As administrator you have the power to log in as any user that you manage and masquerade as them.

Note

Site administrator can log in as any user while institution administrators can only perform this action for users who are members of their institution(s).

It is a great function for troubleshooting a user account because you see everything as the user would without having to know the password.

Warning

This function can be misused by administrators because you can make changes to the user’s portfolio and artefacts as well as participate in groups while logged in as that user. Users should be aware of this function and that an administrator can enter their account.

Sites should have clear policies around the use of this function so that the privacy of users and their portfolios and collaborative work is protected. Therefore, there should also not be many users within an institution who have administrator rights.

Log in as another user

Log in as another user

  1. Click on the user’s name to go to this user’s profile page. You can then click the Log in as … link to become that user from that screen.

  2. Click the Log in as link to become that user. You see a warning bar at the top of the browser window telling you that you are masquerading as that user.

Stop masquerading as another user

Stop masquerading as another user

When you want to return to your own account again, click the Become [your name] again link at the top of the browser window.

When the site administrator enabled the logging of all or just masquerading events, administrators may be required to provide a reason for the masquerading and a notification about this may be sent to the users.

Provide a reason for masquerading as another user

Provide a reason for masquerading as another user

  1. Write why you are masquerading as this user. This reason may be sent to the user if the site administrator demands that.

  2. Click the Continue button to log in as that user.

  3. If the site administrator decided to have users notified of the masquerading, you would see the screen notice “The user has been notified of this masquerading session.”

When the site administrator decided to send notifications to users when an administrator logs into their account, the users receive this notification in their inbox. Depending on their notification settings, it can also be delivered via email.

Notification a user receives when an administrator masquerades

Notification a user receives when an administrator masquerades

  1. Activity type: The masquerading notification is a system message. If you receive a lot of notifications, you can filter for just them.

  2. Click the bar to see the full text of the message.

  3. The system message “An administrator logged in as you” contains the name of the administrator and the time when the administrator started masquerading. If the site administrator requires a reason to be sent for the masquerading, it is displayed as well.

  4. The name of the administrator who logged in as you is linked to the profile page for you to find out more about them or send them a message.

10.4.2.2. Suspend user

Suspend a user if they do not follow the terms and conditions of the site and behave inappropriately. Suspended users cannot log in, but all their content is still available.

Suspend a user

Suspend a user

  1. Click the link Suspend or delete this user. A pop-up windows becomes visible.

  2. Reason: Provide a reason for your suspension. This is particularly useful when you are not the only administrator and / or need to remember after some time why you suspended this user.

  3. Click the Suspend user button to disallow the user from logging in.

Suspension notice on the user account settings page

Suspension notice on the user account settings page

When a user has been suspended, the suspension message appears on the user’s account settings page stating the reason and the date for the suspension and giving the administrators the possibility to unsuspend the user by clicking the Unsuspend user button.

You can unsuspend a user from this page or together with other users on the Bulk actions page.

Suspended user tries to log in

Suspended user tries to log in and gets suspension message

When the user tries to log in, they will see the suspension message and the reason. They can then contact an administrator via the “Contact us” form for further action.

10.4.2.3. Delete user

Users can delete their own accounts in their account settings if self-registration is allowed by their institution. Administrators can also delete user accounts at any time.

Delete a user account

Delete a user account

  1. Click the link Suspend or delete this user. A pop-up windows becomes visible.

  2. Click the Delete user button to delete this user account permanently. This action cannot be undone. As this is a permanent action, you see a confirmation pop-up window that you will have to acknowledge.

Warning

When you delete a user account, all personal data is wiped from the system. This applies to everything that is in a user’s Content and Portfolio area. This action cannot be undone. The user’s contributions in groups, e.g. forum messages, uploaded files and pages created in a group, are still available, but are made anonymous by changing the name to “Deleted user” as author where an author is shown.

Note

If an account was deleted by accident - either by a user or by an administrator - swift action may result in recovery of (most of) the data from a backup file. This requires access to the server’s backups and the backend of Mahara. More information is available on the wiki under Restoring a deleted user.

10.4.2.4. Change site account settings

You can view and change a number of settings for a user’s account.

Note

Depending on the authentication method that is associated with this user, you may not be able to edit all settings.

Site account settings of a user

Site account settings of a user

  1. Change username: Give the user a different username. This field is not available when the account is managed by an external authentication method.

  2. Reset password: Change the password for this user account. This field is not available when the account is managed by an external authentication method.

  3. new in Mahara 18.04 The password strength indicator gives you an idea of how strong your password is in relation to the password policy.

  4. Force password change on next login: Change the switch to “Yes” if the user shall change the password upon the next login. This option is not available when the account is managed by an external authentication method.

  5. Site staff: Change the switch to “Yes” if the user shall become a staff member for the entire site.

  6. Site administrator: Change the switch to “Yes” if the user shall have full administrative rights for the entire site.

  7. Primary email: Displayed is the primary email address for this user. This email address is used for any notifications. You can change that email address here.

    Note

    The previously used email address stays in the user account as secondary email address until the user deletes it.

  8. Disable email: Change the switch to “Yes” to disable the sending of emails for this user. If email is disabled, notifications and messages can only be viewed in the internal inbox. You can set up your Mahara site so that emails are disabled automatically if they are bounced back.

    Warning

    When the email address is disabled, users cannot reset their passwords themselves as no email can be sent.

  9. new in Mahara 18.04 Last login: The date and time when the user logged into Mahara for the last time is displayed.

  10. Account expires: Enter a date via the calendar if you want to set an expiry date.

    Note

    The default setting is that the date is not specified. You can set an automatic account expiry date for all users in the account settings of the site configuration.

  11. File quota: Change the storage allowance for a user’s personal files area. Institution administrators may not be able to update the quota if the site administrator disallowed that. The default value as set in the files configuration in the plugin administration.

  12. Quota used: You can see how much this user has already used of their allocated quota.

  13. Spammer probation status: This setting controls whether the user is considered to be on probation as a possible spammer. See the spam probation levels for more information.

    Note

    This feature is only available on sites that have spam probation turned on.

  14. Authentication method: Choose the authentication method for this user. A site administrator can set up the authentication methods in the institution administration. Depending on the authentication method that you have chosen, you may have to provide a remote username to allow the user to log in.

    Note

    The field Username for external authentication is only displayed if an authentication method is chosen that requires a remote username. This allows administrators to see if a remote username has been supplied or not.

  15. Tags: A user can be tagged by an administrator. The tag of the institution to which the user belonged prior to joining a new institution is not displayed to avoid its deletion.

  16. Click the Save changes button when you are done editing the settings.

10.4.2.5. Change institution settings

You can view and change settings regarding a user’s membership in institutions. Depending on the site settings for institutions, a user may be added to more than one institution.

Institution settings for a user

Institution settings for a user

  1. Institution: Choose the institution to which you want to add this user from the drop-down menu.

    Note

    Only site administrators or institution administrators who have administrator permissions in more than one institution see this option.

  2. Click the Add user to institution button to make this user a member of this institution.

  3. Click the Institution settings bar to see more details about the user in this institution. The bar shows the name of the institution.

  4. Membership expires: Click into the field to view the date picker and choose when you want to remove this user from this institution. The user is removed from your institution on that date, but retains their account and can still log in.

    Note

    The default setting is that the date is not specified. You can set an automatic institution membership expiry date for all users in your institution in the settings for your institution.

  5. ID number: Provide an optional identifier for this user in this institution. This field is not editable by the user.

  6. Institution staff: Change the switch to “Yes” if you want to give this user staff rights in this institution. This will allow the user to create controlled groups for example.

  7. Institution admin: Change the switch to “Yes” if you want to make this user an administrator of this institution. This will allow the user to manage all users in this institution for example.

  8. Click the Update button to save your changes.

  9. Click the Remove user from this institution button to disassociate this user from this institution. The user’s account will not be deleted. The user will only not be associated with this institution anymore.

10.4.3. Suspended and expired users

Administration → Users → Suspended and expired users

A list of all suspended and expired users is available in the sub-menu Suspended and expired users. Here you can unsuspend / reactivate or delete them.

Note

Site administrators see all users whereas institution administrators only see users who are members of their institution(s).

10.4.3.1. Suspended users

List of all suspended users

List of all suspended users

  1. Show: Select to view suspended users.

  2. Basic details about each account are displayed to ensure that you are looking at the correct ones. That includes displaying the suspension reason.

  3. The total number of suspended users is shown.

  4. Select the user(s) for which you want to perform the same action.

  5. new in Mahara 18.04 Click the All button if you want to select all suspended users or click the None button to reset your selection.

  6. Click the Unsuspend users button to reinstate the accounts for all selected users.

  7. Click the Delete users button to delete all selected users in bulk. This action cannot be undone and all personal information of these users will be deleted (see delete user).

Warning

When you delete a user account, all personal data is wiped from the system. This applies to everything that is in a user’s Content and Portfolio area. This action cannot be undone. The user’s contributions in groups, e.g. forum messages, uploaded files and pages created in a group, are still available, but are made anonymous by changing the name to “Deleted user” as author where an author is shown.

10.4.3.2. Expired users

List of all expired users

List of all expired users

  1. Show: Select to view expired users.

  2. Basic details about each account are displayed to ensure that you are looking at the correct ones. That includes the dates on which the accounts were expired.

  3. The total number of expired users is shown.

  4. Select the user(s) for which you want to perform the same action.

  5. new in Mahara 18.04 Click the All button if you want to select all expired users or click the None button to reset your selection.

  6. Click the Reactivate expired users button if you want to allow these users access to their accounts again.

  7. Click the Delete users button to delete all selected users in bulk. This action cannot be undone and all personal information of these users will be deleted (see delete user).

Warning

When you delete a user account, all personal data is wiped from the system. This applies to everything that is in a user’s Content and Portfolio area. This action cannot be undone. The user’s contributions in groups, e.g. forum messages, uploaded files and pages created in a group, are still available, but are made anonymous by changing the name to “Deleted user” as author where an author is shown.

10.4.4. Site staff

Administration → Users → Site staff

Note

Site staff is only accessible by site administrators.

On this page you can choose which users receive site staff rights. Potential staff members - any user on the site - are listed on the left while existing site staff members are listed on the right.

Site staff users

Give site staff rights

  1. Search: If you have too many users on your site and you cannot see the users you want, you can search for them here.

  2. Potential staff: Select the users you wish to make site staff. You can select multiple users at once using Ctrl and Shift click.

  3. Add the potential staff members to the right-hand side - Current staff - by clicking the right-arrow button .

  4. Current staff: If you want to remove an existing or accidentally added site staff member, you can remove the user from the list on the right-hand side by clicking on the user.

  5. Then click the left-arrow button , and the user is removed from the list.

  6. When you have chosen all members you wish to make site staff, click the Submit button.

Note

You can also double-click a name and it will be moved to the other side.

10.4.5. Site administrators

Administration → Users → Site administrators

Note

Site administrators is only accessible by site administrators.

Site administrators have powerful permissions. They can make far-reaching changes and also log in as other users. Be careful whom you give these rights. One site administrator is needed for each site. The total number of site administrators should be kept small.

Give site administrator rights

Give site administrator rights

  1. Search: If you have too many users on your site and you cannot see the users you want, you can search for them here.

  2. Potential administrators: Select the users you wish to make site administrators. You can select multiple users at once using Ctrl and Shift click.

  3. Add the potential site administrator to the right-hand side - Current administrators - by clicking the right-arrow button .

  4. Current administrators: If you want to remove an existing or accidentally added site administrator, you can remove the user from the list on the right-hand side by clicking on the user.

  5. Then click the left-arrow button , and the user is removed from the list.

  6. When you have chosen all members you wish to make site administrators, click the Submit button.

Note

You can also double-click a name and it will be moved to the other side.

10.4.6. Export queue

Administration → Users → Export queue

This feature is experimental.

The export queue is available for the following exports:

  • When group administrators or tutors release portfolios in groups that allow the archiving of submitted pages, these submissions will be placed into the export queue and only released once the export completed successfully.

  • If the site administrator enabled the feature to queue Leap2A exports, Leap2A exports that users initiate via Portfolio → Export are also queued, and once completed, the users receive a notification.

See also

The export queue requires that cron runs.

Export queue for Leap2A exports

Export queue for Leap2A exports

  1. Search: Enter your search term. The default text in the field shows you in which institution context you perform your search. Type the name, display name or username or email address or any partial thereof you wish to search for in the search field. If you turned on the exact search, you need to provide the correct name or email address and not a partial one.

  2. Use the drop-down arrow to choose a single institution in which to search for your user.

  3. Click the Go button to start your search.

  4. In the results table you see the profile picture of the user.

  5. First name: Displays the first name of the user. This is the default column for sorting results.

    Note

    Click on the other headings of the table that are links to sort the table differently.

  6. Last name: Displays the last name of the user.

  7. Display name: Shows the display name of the user.

  8. Username: Clicking on the username, you are taken to the user’s administration settings page instead of their profile page as you would with the other names.

  9. Export content: Brief description of what is being exported.

  10. Status: Displays the status of the export. Only pending and failed exports are shown.

  11. Export: Tick the checkboxes in this column if you wish to re-run an export that has failed. You can select all checkboxes by clicking the All button or remove all checkboxes by clicking the None button.

  12. Click the Re-queue button to re-run all selected failed exports.

  13. Delete: Tick the checkboxes in this column if you wish to delete any pending or failed exports. You can select all checkboxes by clicking the All button or remove all checkboxes by clicking the None button.

  14. Click the Delete button to delete all selected pending or failed exports.

10.4.7. Add user

Administration → Users → Add user

You can add users to your site (site administrator) or your institution (institution administrator) by creating accounts for them manually one by one.

Add a user manually

Add a user manually

  1. Click the Create new user from scratch radio button if you want to create an empty account. Provide the first name, last name and email address for this user.

  2. Click the Upload Leap2A file radio button if you want to import a user from another Mahara instance or a system that supports the Leap2A standard. Such a user could have exported their portfolio from another Mahara instance.

  3. Username: Give the new user a username. It may contain letters, numbers and most common symbols. It must be from 3 to 236 characters in length. Spaces are not allowed.

  4. Password: Choose a password for the account. The password must be at least six characters long.

  5. new in Mahara 18.04 The password strength indicator gives you an idea of how strong your password is in relation to the password policy.

  6. Site staff: Switch to “Yes” if the new user should have site staff rights. Only site administrators see this option.

  7. Site administrator: Switch to “Yes” if the new user should have site administrator rights. Only site administrators see this option.

  8. Institution: Choose the institution of which the user should be a member. You also select the authentication method directly here.

    Note

    If an authentication method requires the use of a remote username, you can enter that on the next screen in the account settings.

  9. File quota: Review the allocated file quota. You may change it here for this user if you are allowed to.

  10. Institution administrator: Switch to “Yes” if the new user should have institution administrator rights in the chosen institution.

  11. General account options: Click this link to see default account options that you may choose to change while creating this user. These are the general account options a user can change on the Settings page.

    Note

    You can only define the default account settings for a user account, but not force the user to keep them forever. You could only do that by customising the system on the code level.

  12. Click the Create user button.

  13. The user will receive an email with the account details.

10.4.8. Add and update users by CSV

Administration → Users → Add users by CSV

You can use this function to upload new users in bulk via a CSV file (comma-separated file) and to update existing users. The first row of your CSV file should specify the format of your data. For example, it should look like this:

username,password,email,firstname,lastname,studentid

For new users, this row must include:

  • username

  • password

  • email

  • firstname

  • lastname

Note

Mahara also accepts CSV files that have a semicolon as separator instead of a comma.

If you want to update existing users, you do not need to set a password and can leave that field off entirely.

Note

You can mix new and existing accounts in your CSV file. When you add a new user, the password field must be present. If you do not wish the password to be changed for existing accounts, leave that field empty for these accounts.

If your site or institution has locked fields or fields that are mandatory, then you do not have to include them as fields in your CSV upload.

Here is the full list of additional fields that you can add in your CSV file upload.

  • address - Street address

  • blogaddress - URL to the blog

  • businessnumber - Work phone number

  • city - City

  • country - Country

  • faxnumber - Fax number

  • homenumber - Home phone number

  • industry - Industry is displayed in the profile

  • introduction - Introduction is displayed in the profile

  • mobilenumber - Mobile phone number

  • occupation - Occupation is displayed in the profile

  • officialwebsite - Official website

  • personalwebsite - Personal website

  • preferredname - Display name

  • remoteuser - Remote username for external authentication

  • studentid - Student ID is displayed in the profile

  • town - Town

Your CSV file could look for example like the following:

username,email,firstname,lastname,studentid,preferredname,remoteuser, password
"percy","percy@pearle.net","Percy","Pearle","","","percy.pearle","mahara1"
"petra","petra@petterson.net","Petra","Petterson","","","petra.petterson","mahara1"
"polly","polly@potter.net","Polly","Potter","","","polly.potter","mahara1"
"admin","admin@mahara.school","Admin","User","","","","mahara1"
"jamesj","james@jetts.com","James","Jetts","","","","mahara1"

When you have created your CSV file, you are ready to upload it.

Add users by CSV file

Add users by CSV file

  1. Institution: Choose the institution and the authentication method for the user accounts that you upload and / or change.

  2. File quota: If you wish, you can set a different file quota for all accounts in the CSV file. Institution administrators can only do so if the site administrator allowed it.

  3. CVS file: You must upload a CSV file by clicking the Browse button and then selecting it from the files area on your computer.

  4. Force password change: If you select this option, users need to change their password before they can log in for the first time.

  5. Email users about their account: Change the switch to “Yes” and users will receive an email with their account information. This is in particular good for internal accounts.

    Note

    For user accounts that are managed by an external authentication method such as Moodle or LDAP, do not select this option because the users already know their login information.

  6. Update users: Change the switch to “Yes” if your CSV file contains changes for existing users.

    Note

    When you add a new email address for a user to update the account settings, this new email address becomes the primary email address.

    The previously used email address stays in the user account as secondary email address until the user deletes it.

  7. General account options: Expand this menu to see default account options that you may choose to change while creating or updating users. These are the general account options a user can change on the Settings page.

  8. Click the Add users by CSV button to upload and / or change users.

Note

Depending on your server settings and / or the size of your installation, you may not be able to upload all user accounts at once. You may wish to upload them in bunches of 100 instead.

A progress bar shows the percentage of the completed upload of your users.

add_user_csv_progressbar

10.4.9. Change the authentication method and remote username in bulk

After you have successfully invited or added new members into your institution, you can change their authentication method. That can be useful if the authentication method differs from the one in the previous institution and you want to link the new accounts to a remote username using:

  • LDAP directory

  • Moodle accounts via MNet

  • Single sign-on through an IdP provider

Note

The change in the authentication method for existing accounts should be done before users try to log in with their new credentials to avoid the creation of a second account for these users.

You can change the authentication method for multiple users at once to save you time manually updating each user. Changing the authentication method usually also entails changing the remote username (a.k.a. username for external authentication). Therefore, these two are dealt with together to describe the work flow better.

Find users in an institution to change their remote username

Find users in an institution to change their remote username

  1. Go to Administration → Users → User search.

  2. Click the Advanced options link to show filter options.

  3. Filter for users by specific characteristics, e.g. if you only wish to display users who have not logged in yet.

  4. Search: Enter your search term. The default text in the field shows you in which institution context you perform your search. Type the name, display name, username or email address or any partial thereof you wish to search for in the search field. If you turned on the exact search, you need to provide the correct name or email address and not a partial one.

  5. Use the drop-down arrow to choose a single institution in which to search for your user.

  6. Click the Search button to start your search.

  7. Change the Results per page if you wish to see more than 10 users per page.

  8. Select the users whose authentication method and remote username you want to change by either putting a check mark in the checkboxes or clicking on All to select all users on that page.

  9. Click the Get reports button to proceed to the next step. You are taken to the User details report page.

User details reports page

User details reports page

Update the CSV file

Update the CSV file with remote username and password

Update user accounts in bulk

Update user accounts in bulk

  1. Click the Download button so that you get a CSV file which contains all necessary information for you to change the users’ remote username in bulk. This is necessary if their internal Mahara username is not the same as the one they use to authenticate on your system that is linked to Mahara or if they already have a remote username that would be incorrect for your institution.

    Note

    You do not need to see the column “Remote username” for the data to be in the CSV download. If you wish to see it on screen, click the Configure report button and select the “Remote username” column.

  2. Open the CSV file in your preferred spreadsheet software. In the column remoteuser, add or change the username that your users have when authenticating in your regular system that you have connected to Mahara. You may also change other fields, e.g. their name, email address etc. If you want to add a new user directly in this CSV file, you can do so as well.

    Note

    You must provide a password for a new user. All other users do not need to have a value in the password field. If you only want to update existing users, you can leave the password field entirely off.

    You must remove the column “lastlogin”. Mahara will produce an error if you leave it in the file.

  3. Go to Administration → Users → Add users by CSV.

  4. Institution: Choose the correct institution and authentication method for which you want to update your users. This allows you to switch all users in the CSV file from one authentication method to another.

  5. File quota: Choose a different file quota here if you want to update it for the users you upload.

  6. CSV file: Choose the CSV file from your computer that you had updated.

  7. Update users: Switch this option to “Yes” because you want to update existing user accounts.

    Note

    Switch the options Force password change and Email users about their account to “No”. When you add a remote username, your users do not need to know their internal Mahara password as they cannot use it anyway.

  8. General account options: You can make changes to the default account options for all the users, e.g. give them multiple journals by default, change their interface language etc.

  9. Click the Add users by CSV button to start the user update. This process may take a little while depending on how many users you are changing.

  10. You receive a report on the page upon the successful completion of the upgrade. If the upgrade fails, error messages help you to resolve the problem. No users are updated until all errors are resolved.

Note

If you intend to update more than 100 users at the same time, you may run into problems, and the server may reject your CSV file as the update process is a very memory intense one. If that is the case, you would have to split your CSV file into smaller ones with fewer users in them.

You can check that the accounts had their remote usernames added:

  1. Go to Administration → Users → User search.

  2. Select the institution in which the members are whom you want to check.

  3. Click the Search button to limit your user results to this institution.

  4. Select the users for whom you want to check the remote usernames.

  5. Click the Get reports button to proceed to the next step. You are taken to the User reports page.

  6. You see the remote username in the last column.

See also

If you only want to change the authentication method of certain users but do not have to worry about a remote username or updating any other information, you can change the authentication method directly on the bulk actions screen.