User Management

Open User Management from a named AS/400 (TN5250) connection: the Connections page User Management button, or the connection picker on the User Management page. Mock connections are not listed. Managed users, identity policy, device names, and session limits apply to that connection only.

When Require external identity is on, choose how the username arrives: External JWT or Trusted headers. Kerberos S4U impersonates whichever identity that mode resolves.

• External JWT: set the launch query parameter name and the username claim. OL Terminal decodes the payload only (no signature verification). Test JWT is for local testing only and is hidden in trusted-header mode.
• Trusted headers: the reverse proxy injects the configured user header and a shared-secret header (default X-OL-Proxy-Secret). The secret is write-only (minimum 32 characters). The proxy must strip any client-supplied copy of both headers. The OL Terminal backend port must not be reachable except through that proxy.

Configure Custom Columns selects deviceName, enablePrinter, printerQueue, and numberOfSession. Empty or inactive values inherit connection or global defaults. Global Printer Support remains the master switch.

Allow automatic device-name increment controls TN5250 device-name collisions. When it is off, set one unique deviceName per allowed concurrent session.

CSV: import and export users for the selected connection. Columns include username, enabled, device names, session count, printer access, and output queues. Multiple device names and queues can be listed in one cell. A preview runs before apply. Username lookup is case-insensitive.

Assigned output queues: when printerQueue is set on the user (and Printer Support is on), the printer panel may search only those IBM i *OUTQ values. The device-location filter is blocked; preview, download, and delete follow the file's actual queue. A 403 on a device filter or on a queue that is not assigned is expected.

When user management is enabled: missing identity or secret returns 401; unknown or disabled user returns 403. authenticatedUsername in session info is the managed identity; user is the host-login name detected later on the terminal screen.

See also [[feature:admin-user-management]] and [[feature:as400-printer-integration]].