Features

Instead of keeping separate user lists on every server, link each server to Control. People sign in with one account, and Control tells each server which role that person has there.

Accounts

• Built-in accounts, or Active Directory / LDAP(S) sign-in where directory groups decide who gets what
• Add someone with a one-time password they change at first sign-in
• Control portal access: None, Viewer or Administrator
• Disable someone to stop them signing in anywhere, and unlock them after too many wrong passwords

Groups and role maps

• A group is a name, a note and, optionally, a directory group
• Each server has a role map; the first matching line wins, so specific lines go above general ones
• Who can be everyone, a group or a person; anyone matching no line cannot sign in to that server

Manic Toolkit apps

• Apps check their sign-ins with Control; deploy the link to every computer with a control.json file
• Lockout in steps: 5 minutes after 3 wrong passwords, 15 minutes after 3 more, then locked until an administrator unlocks it
• Apps check in every 30 seconds, even while locked, so an unlock takes effect within moments
• If Control cannot be reached, the app accepts the last good sign-in on that computer