Run it
People and sign-in
How people join, how they sign in, what each role can do, and how to get back in. Single sign-on is coming with Enterprise.
Roles
Everyone in the workspace has one workspace role. There is always exactly one owner, the person who set it up, and the owner can hand ownership to another admin.
- Owner and admin manage people, settings and spaces, and are admins of every space. Only they can use Computer and local spaces.
- Member uses the spaces they are added to, each with a space role of viewer, member or admin (see Spaces).
- Auditor reads the audit log and nothing else. It comes with Enterprise.
Ways to sign in
- Password. At least 12 characters, and not one of a list of common passwords. After repeated failures the wait before the next try grows.
- Passkey. Several per person, added in your profile. Passkeys need HTTPS on a domain name. A passkey belongs to the address it was made on, so one made on your domain does not sign in through the tunnel, and your profile says which address each belongs to.
- Emailed code. Six digits, valid for 10 minutes, used once. It is offered only when email is set up in Settings.
- Sign in with TurnPanel. See below.
Stronger from outside
From your local network, a password alone is enough. From outside it is not, by default. After the right password, TurnPanel emails a code to finish signing in. Without email set up, a password from outside is refused with an explanation. A workspace admin can allow password-only sign-in from outside, with a warning. Passkeys and Sign in with TurnPanel are strong from anywhere.
Sign in with TurnPanel
If the workspace is connected to a TurnPanel account, people can link their own TurnPanel account to their person and then sign in with one button, from anywhere, including through the tunnel. The sign-in page shows Sign in with TurnPanel only when it is available.
Linking is explicit. Only an account someone linked can sign in, never one that merely has the same email. Link yours from your profile. The admin who connects the account is linked automatically. An admin can turn the option off in Settings under Signing in.
Inviting people
In Settings under People, enter an email, a role and, if you like, spaces with roles. With email set up, TurnPanel sends the invitation. Otherwise it gives you a link to share. The link works once and for 7 days. Invitations that are still open are listed, and you can resend (new link, 7 more days) or revoke them.
The invited person sets a password or a passkey on their first visit. Only admins can be added to Computer and local spaces.
Removing people
Removing a person ends their sessions and keys at once, takes them out of their spaces and pauses automations that run as them. Their history stays in the audit log.
Getting back in
- With email set up, a forgotten password is reset with an emailed code. Without it, an admin creates a reset link.
- As a last resort, run
turnpanel users reset <email>on the machine itself. Whoever can reach the machine is the root of trust. - Before the first owner exists,
turnpanel setup-linkon the machine prints a link to set the workspace up. - Sessions last 30 days idle (7 on plain HTTP) and can be revoked from your profile, or by an admin.
Single sign-on
Single sign-on with SAML or OpenID Connect, and SCIM provisioning, are coming with TurnPanel Enterprise. They are not in the product today.