Customers and security¶
The Password and Security panel¶
Open a customer from Customers, All Customers and go to Password & Security. The rows there are the account actions. They only appear once the customer has been saved.
| Row | What it does |
|---|---|
| Reset Password | Sends the customer a link to choose a new password. Asks first |
| Set Password | Sets a password on their behalf. See below |
| Force Sign-In | Requires the customer to sign in again on their next visit |
| Allow remote shopping assistance | The customer's consent to being signed in as. They can give and withdraw it themselves |
| Login as Customer | Opens the storefront signed in as this customer |
Sending a reset email is the better first move. A link only the account holder can open is safer than a password an employee knows.
Two stock actions are not on this screen
Create Order from a customer is not offered here. Start the order from Sales, Orders, Create New Order and pick the customer there. Unlock is not a row of its own either. Unlocking is a tick box inside the Set Password dialog, so a locked account cannot be unlocked without setting a password at the same time. Both were buttons on the core customer_form component, which Nebula removes because the customer screen is its own form.
Setting a password¶
Use this when the customer cannot reach their email. The password you set is temporary: the customer is asked to choose their own the next time they sign in.
- Click Set Password….
- Type a password, or press Generate for a strong one. Generate shows what it made so you can read it out, and leaves out characters people mishear on a telephone, so there is no l against 1 or O against 0. Copy puts it on your clipboard, and the eye beside the field shows and hides it.
- Type your own administrator password under Confirm it is you.
- Decide about the two options.
- Click Set password.
| Option | Default | When to change it |
|---|---|---|
| Email the customer that their password changed | On | Turn it off only when the customer is in front of you |
| Unlock the account | Off, and only shown when the account is locked | Tick it to let the customer straight back in. Leave it if the lock was caused by someone guessing |
The rule your store enforces is written under the password field, for example at least eight characters from at least three character types. A password that breaks it is refused and the message names the rule.
What happens next¶
The customer is signed out on every device, immediately. They receive an email unless you turned that off. The next time they sign in, the storefront sends them to the change-password form from wherever they are, with the notice Your password was set by our team. Please choose your own before you continue. The gate is not limited to their account pages, so a category page, a search or checkout redirects as well. What stays reachable is the account page and its save, sign out and the page after it, and the pages behind a reset link. The storefront's own header data keeps loading throughout. They are then offered a passkey or an authenticator app, which they can ignore.
A reset link does not end the prompt
The nebula_must_change_password flag comes off only when the customer changes their password from inside their account, supplying the current one. A customer who uses Forgot your password and follows the reset link ends up with a password of their own but keeps the flag, so the next sign-in sends them to the change-password form again and they have to change it a second time. Tell them the way out is Account Information, Change Password.
If it refuses¶
| Message | Meaning |
|---|---|
| That is not your password | Your own administrator password was wrong. Three wrong answers in one session signs you out of the admin |
| A message about length or character types | The password does not meet your store's policy. The rule is under the field |
| The password can't be the same as the email address | Exactly that |
Setting a password is its own permission, separate from editing a customer. If the button is not there, ask for Set A Customer's Password. It cannot be done for many customers at once, deliberately, and it never reveals the old password, which is not stored by anyone.
Signing in as a customer¶
The Login as Customer rows are hidden rather than greyed out when the store is not set up for them, so a missing row is a setting or a permission and not a fault. All three of these must be true before the rows are drawn:
- The modules are enabled.
Magento_LoginAsCustomerandMagento_LoginAsCustomerAdminUi. - The feature is on.
login_as_customer/general/enabledis set to Yes. - Your role holds the permission.
Magento_LoginAsCustomer::login. A role without it sees no row at all.
Press Start session… in the Password and Security panel. A dialog explains that you will act as that person on the storefront, in a new tab, and that anything you do there is done as them. You are asked to choose a store view only when login_as_customer/general/store_view_manual_choice_enabled is on and the customer has more than one store view available. Otherwise the store view is chosen for you and you only confirm.
While a session is open the row says so and offers End session. Every visit is recorded in the Login as Customer Log.
The customer must have allowed remote shopping assistance first. The Allow remote shopping assistance row is where you record that consent, and customers can give and withdraw it themselves from their account. That row needs Magento_LoginAsCustomerAssistance. Changing the consent needs the separate Magento_LoginAsCustomer::allow_shopping_assistance permission, and a role without it sees the row with its switch greyed out. Without the module the row is absent and Nebula records no consent, which leaves the question of whether a session is allowed to Magento's own check.
A customer's passkeys and two-step verification¶
The customer edit screen shows how many passkeys the customer has registered and whether two-step verification is on, with how many recovery codes remain.
Both are set up by the customer on their own device, and neither can be created for them. Clear them only when the customer is locked out:
| Button | What it does |
|---|---|
| Remove all passkeys | Deletes every passkey on that account, so the customer can register again |
| Turn off two-step verification | Switches it off, so the customer can set it up again |
The customer list can show the same information. Two columns, Passkeys and 2-Step, are hidden by default. Turn them on from the Columns menu. Both can be filtered, so you can list every customer with no passkey, or everyone with two-step verification on.
Your own passkeys¶
System, Permissions, My Passkeys manages the passkeys you use to sign in to the admin.
Press Add Passkey and follow your browser's prompt. You are then asked to name it, because a name is what tells your passkeys apart when you have more than one. Something like MacBook Touch ID works well.
The table lists each passkey with when it was created and when it was last used, or Never. Rename edits the name in place. Delete asks first and names the passkey you are about to lose.
A passkey can only be created by the person who will use it, on their own device. An administrator editing another user can remove that user's passkeys so they can start again, but cannot create one for them.
Your own two-step verification¶
System, Permissions, 2FA is Nebula's own second factor, and it asks for a code from an authenticator app when you sign in. It is asked for only on an install where Magento_TwoFactorAuth is disabled, which is the install this section describes.
On a stock install this is not the factor you are challenged for
Magento_TwoFactorAuth is enabled on a stock install, and Nebula's own enforcement stands down whenever it is. Security explains why. Enrolling here then writes a second authenticator entry, in Nebula's own tables, that is never asked for at sign-in, and opening the challenge page sends you to the dashboard. The factor you are actually challenged for is the provider you chose at first sign-in, and its recovery is Magento's rather than the recovery codes described below. A passkey sign-in can waive Magento's challenge through A passkey satisfies two-factor authentication, nebula_passkey/general/passkey_satisfies_2fa.
To turn it on, press Set up two-step verification, scan the QR code with an app such as 1Password, Bitwarden, Google Authenticator or Aegis, and enter the six-digit code it shows. If you cannot scan, the key is printed underneath for typing in by hand.
Once it is on the page shows how many recovery codes remain and offers two actions:
| Button | What it does |
|---|---|
| Generate new recovery codes | Replaces your codes with a fresh set |
| Turn off two-step verification | Switches it off |
Recovery codes are shown once and only once. Each works a single time, and they are how you get back in if you lose your authenticator. Save them somewhere safe when they appear.
Roles¶
System, Permissions, User Roles decides what each administrator may open and do.
Creating a role from an empty permission tree is slow and easy to get wrong, so the role screen offers ten starting points based on a job rather than on a menu.
| Template | What it grants |
|---|---|
| Developer | Full access, including the tools that can take a live site down. The only template that grants everything |
| Store Owner | Everything except cache and index tools, backups, integrations, the encryption key and extension management |
| Store Manager | Sales, Catalog, Customers, Carts, Marketing, Content and Reports, plus attributes and tax. Cannot change configuration |
| Merchandiser | Catalog, inventory, catalog price rules, attributes, ratings and search terms. No orders and no customers |
| Content and Marketing | Campaigns, CMS, email, newsletters, SEO, reviews and product content. Cannot change price or inventory |
| Sales Agent | Processes orders, customers and carts. Cannot issue credit memos, cancel orders or capture payment |
| Sales Supervisor | Everything a Sales Agent can do, plus credit memos, cancellations and payment actions |
| Customer Service | Customer records, login as customer, reviews, and order view, comment, email and reorder |
| Finance | Invoices, credit memos, transactions, billing agreements, every report, tax settings and currency rates |
| Analyst | The dashboard and every report, and nothing else |
Every template also grants the two permissions an administrator needs to answer two-step verification at sign-in. They are not part of the job the template describes, and a role without them cannot reach any screen at all on a store with two-step on.
Click a template card to preview it. Choose Replace to swap the role's permissions for the template's, or Add to current to add them on top of what the role already has. A chip shows how many permissions would be added and how many removed.
Apply to tree ticks and unticks the permission tree to match. Nothing is saved until you press the role's own Save, so you can apply a template, adjust the tree by hand, and save the result. Cancel clears the preview.
A card may warn that some of its permissions are not installed on this store. Those are skipped rather than granted.
Role Users¶
Role Users is the last section of the role screen, and it is where people are put into the role. On a role you have not saved yet it shows only Save the role first to assign users to it. Give the role a name, save it, and the list appears.
The list opens on In this role. Switch to All users to see everyone, and narrow either view with the Filter users by name, email or username… box. A chip on the right reads Assigned: n, which counts every ticked box rather than what is saved, including ticks the filter or the In this role view is hiding.
Read the Current Role column before you tick anyone. An administrator may hold only one role, so ticking someone who already belongs to a different role asks Reassign user? and names the role they are in. Yes, move takes them out of that role. Cancel leaves the tick off. Unticking, or ticking someone with no role, asks nothing.
Nothing is written until the role's own Save, which also wants your own password in Your Current Password at the top of the screen.
Adding an administrator¶
Go to System, Permissions, All Users and press Add New User.
- Fill in User Name, First Name, Last Name and Email. All four are required.
- Set a Password and repeat it under Password Confirmation. A password is required when you create a user. On an existing user, leaving both empty keeps the current password.
- Choose an Interface Locale, and leave This account is set to active unless you are preparing the account ahead of time.
- Pick the role under User Role. Assigned Role is one dropdown on the same page, not a grid of radio buttons on a second tab, and the templates above are what its choices grant.
- Type your own password under Your Current Password. Nothing is saved without it.
A saved user carries two more actions. Force Sign-In revokes their tokens, so they are signed out of the admin and out of any API session, and asks first. Delete User asks first as well and needs your own current password filled in on the form.
Permissions that hide a field¶
Some permissions protect a single field rather than a whole page. Price and inventory on the product screen work this way.
If your role does not hold the permission, the field is not shown to you at all. It is not greyed out and there is no message, because there is nothing for you to decide. The same rule is enforced when the product is saved from the admin form and when it is written through the REST API. It does not cover a CSV import or anything run on the server from the command line, so whoever can run an import can still change the field.
If a product field you expect is missing, that is the reason. Ask whoever manages your roles.