User Administration
User Administration is currently still in the pilot phase.
The User Administration allows Saferpay Backoffice user accounts to be administrated independently via the Saferpay Backoffice. Provided that the required permission has been activated, the corresponding menu item can be found under "Settings" --> "User Administration" or under the following URL: https://www.saferpay.com/BO/Settings/UserManagementOverview
In this chapter you will find all the necessary information.
The Merchant Administrator manages the users of the currently selected Saferpay account. The administrator has the possibility to assign the role "Merchant Administrator" to further users created via Backoffice. Merchant Administrators cannot edit their own profiles. Merchant Administrators can also create Multi-Customer Users. Once created, the Merchant Administrator can still edit user permissions and status, but not user data. This data can only be edited by users themselves.
In this menu ("Settings" --> "User Administration"), the existing users are displayed and new users can be created. Via the link "Details" the data of an existing user can be adjusted and the assigned roles can be changed.
Currently, only user accounts created by a merchant administrator are listed here. With a later Saferpay release, the list will also include all existing user accounts.
Currently, a user cannot be deleted. But if you want to prevent a user from accessing the backoffice, you can set its status to disabled. See chapter Enable/Disable a user.
The following statuses are possible:
- Activation link was sent --> User has not yet called the activation link.
- Active --> User is active and can log into the back office
- Deactivated --> User is disabled by merchant administrator and cannot log into the back office
- Locked --> User is locked (e.g. due to too many failed login attempts or inactivity)
- Password expired --> Password expired
The following matrix shows all available roles and the corresponding permissions. These can also be viewed in the Saferpay Backoffice under "Settings" --> "Roles and permissions" or via the following link: https://www.saferpay.com/BO/Settings/RolesPermissionsTable
User administrators can create new users in the Saferpay Backoffice. Different roles are assigned to each user, which influence which permissions and accesses a user receives.
There are two different types of users:
- Individual unique e-mail address (Verified)An activation email is sent directly to the specified email address.
Using this user type is recommended.
Since sensitive data is sent to the user's email address, e.g. to activate the user account or reset the password, it is essential that each user is assigned a personal email address to which only the individual user has access. Avoid using group mailboxes.
Verified: Individual unique email address
- System-generated username (Unverified)The username is generated by the system. The activation link must then be sent to the user manually.
Using this user type is not recommended, and should only be used if the user does not have their own email address. Without an email address, some features may not be usable.
Unverified: System-generated username
The newly created user then receives an email at the email address provided containing an activation link.
After calling up the link, the user account is activated and the user must enter an individual password for it.
The Merchant Administrator must manually send the activation link to the user.
After calling up the link, the user account is activated and the user must enter an individual password for it.
Users created by a merchant administrator can log into the Saferpay Backoffice using their personal e-mail address or the system-generated username and an individually defined password.
Password handling for Unverified users: If too many login attempts fail, the user is automatically locked. A corresponding message will be displayed and the user administrator should be contacted. However, this is not mandatory, because after 30 minutes the locked status is reseted and the user can log in again. Since there is no email address for Unverified users, no password reset links can be sent, that means the password cannot be reset independently. For this reason the user administrator must be contacted. The administrator will then generate a password reset link and send it to the user.
Verified: Individual unique email address
Password handling for Verified Users: For Verified Users, the password reset link is sent directly to the user's email address. This can either be initiated by the user administrator or the user can request a reset link on its own via the forgotten password function on the login page.
Unverified: System-generated username
A password reset has no effect on the user status.
There are two reasons why a user login becomes locked.
- Locked because of too many wrong password entriesIf a wrong password is entered too often on the login page, the user login will be automatically blocked for 30 minutes. After that the user can try again. Verified user logins with individual email address can request a password reset link to unlock their login. Unverified Users without email can contact the Merchant Administrator for the unlock so they do not have to wait 30 minutes.
- Locked due to inactivityAfter 90 days without login, the next time the user tries to log in, the user will see a message that its login is locked. In this case the user cannot unlock its login by himself, only the merchant administrator can unlock the login by sending the user a password reset link.
In the User Administration overview, users can be edited via the "Details" link. It can be defined whether a user should be active or inactive, as well as the assigned roles. Merchant Administrators cannot edit user data. This data can only be edited by users themselves.
Edit user from the administrator's point of view:
Edit user from user view:
User type "individual unique e-mail address" (verified) can no longer be changed.
User type "system generated username" (unverified) can be changed to a verified user type at any time. In this case the system generated username will be replaced by an email address. The original username will then no longer be usable. An activation link will then be sent to the email address and the user account can be activated. The old passwords will be stored in the history and cannot be used again for login.
Unverified: System-generated username --> Verified: Indiviual unique email address
The new password must be different from the last five passwords an must not have been used in the last 24 hours.
- Only user accounts created by a merchant administrator are listed in the user overview. With a later Saferpay release, the list will also include all existing user accounts.
- A user cannot be deleted. But if you want to prevent a user from accessing the backoffice, you can set its status to disabled. See chapter Enable/Disable a user.
- Merchant Administrators cannot edit their own profiles.
- Merchant Administrators can only edit status and permission of users. The users can edit their data in User Profile.
Saferpay users who own individual user accounts (Backoffice logins) for several customer accounts (CustomerIDs) can now be merged into a single user account which provides access to all related accounts (multi-customer access). This avoids maintaining and keeping track of multiple user accounts and passwords and eliminates friction when working under several customer accounts.
The Multi-Customer Access functionality is activated by creating a user with an email address that already exists for another user of another merchant account.
To switch between multiple user accounts, click on the customer ID in the upper right corner next to the user name. On the following page all linked customer accounts will be listed.
Last modified 3mo ago