OptimiDoc User Management and Security manages who your users are, what they may do, and how they prove their identity — while keeping their credentials encrypted at rest. Users, departments and groups mirror your organisation; Active Directory keeps them in step with your directory; a range of console and device sign-in methods suits every security posture; and AES-GCM encryption protects sensitive data throughout.
1. Users, Departments and Groups
OptimiDoc organises identity around three concepts:
-
Users — individual accounts. A user carries a name and e-mail, a department, credentials, an optional home folder, a default billing code, an external ID and an expiration date.
-
Departments — organisational units used for cost allocation, quota assignment and reporting. A user belongs to one department.
-
Groups — logical collections used for access control and rule targeting. A user can belong to many groups.
A built-in Everyone group and the primary administrator account are protected from deletion so the system always has a baseline of access.
2. Roles and Access Rights
Two independent mechanisms govern what a user can do.
The Web Interface role controls which parts of the administration console a user can reach:
|
Role |
Console access |
|---|---|
|
User |
Standard access — print, scan and view personal job history. |
|
Department Manager |
Management and reporting scoped to their own department. |
|
Manager |
Broader management and reporting access. |
|
Administrator |
Full access to all configuration, monitoring and reporting. |
|
Local Administrator |
Administrative access for a locally managed administrator account. |
Separately, Access Rights — set per user and per group — govern what operations a user may perform: Copying, Printing, Scanning and Colour, each independently allowed or denied, along with which scan workflows, connectors and billing codes are available to them. Access rights use an allow/deny group model, so you can grant a capability to everyone and then exclude specific groups, or restrict it to named groups only.
3. Signing In to the Web Console
The console supports several sign-in methods, which can be offered together on the login page:
-
Username and password — validated against the local database or Active Directory.
-
OAuth — sign in with Microsoft or Google.
-
Single Sign-On (SSO) — via CAS (Central Authentication Service) for organisations with a CAS identity provider.
4. Authentication at the Device
At the device panel, each device can be configured with the authentication method that suits its location and security needs:
-
PIN
-
Card
-
Card and PIN (two-factor) or Card or PIN
-
Login and Password
-
Card or Login / Card and Login
-
User List (select from a list)
-
Single Sign-On and External Authentication
Card numbers, PINs and passwords are all held as user credentials, and unknown cards presented at a device can be enrolled directly from the Unauthorised Accesses log.
5. Directory Integration
OptimiDoc keeps its user base aligned with your existing directory rather than duplicating account management:
-
Active Directory / LDAP — connect one or more domains, each with one or more search directories (LDAP paths).
-
Attribute mapping — map directory attributes to OptimiDoc fields for department, card number, PIN, home folder, alias, external ID and default billing code.
-
Group-scoped replication — import only the users in nominated groups, and optionally include or exclude incomplete or duplicate accounts.
-
Automatic synchronisation — a scheduled sync keeps users, departments and group membership up to date on a configurable period.
-
CSV import — for environments without a directory, import users from a CSV file (uploaded or read from a server path).
6. Self-service: My Account
End users manage their own account from the My Account page:
-
View their profile (login, name, e-mail, department) and see whether a password, PIN and certificate are set.
-
Change their password and change their PIN (with click-to-reveal).
-
Manage an authentication certificate (upload or replace a .pfx/.p12 file).
7. Security and Encryption
Sensitive data is protected throughout OptimiDoc:
-
Encryption at rest — user credentials and sensitive configuration values are encrypted with AES-GCM (authenticated encryption, with keys derived via HKDF), applied automatically as data is written to the database.
-
Key migration — an administrator-driven tool re-encrypts any legacy-format data to the current scheme.
-
Secure cluster bootstrap — when a new node joins a cluster, it receives the master encryption key over a delegated-authentication channel, so it can read shared encrypted configuration without the key being entered by hand.
-
Failed-access visibility — unknown or failed authentication attempts are recorded in the Unauthorised Accesses log.
-
Session handling — inactivity timeouts prompt the user before expiry and are synchronised across browser tabs.
-
GDPR — per-user data export and anonymisation are available through the GDPR Compliance tools.
In Summary
User Management and Security ties identity, authorisation, authentication and data protection into one consistent model. Directory synchronisation keeps accounts current, roles and access rights decide what each person can do, console and device sign-in methods cover every scenario, and AES-GCM encryption keeps credentials safe — with minimal administrative overhead.