.. SPDX-FileCopyrightText: 2025 Univention GmbH
..
.. SPDX-License-Identifier: AGPL-3.0-only

.. _nubus-user-management-self-service:

End User Self Service
=====================

This section describes the *End User Self Service*
that allows users to manage their contact information,
reset their password,
register for and remove their user account from Nubus
without administrator interaction.

For information about setting a user password policy,
see :ref:`nubus-user-password-management`.

.. seealso::

   :external+uv-nubus-customization:ref:`customization-theme-self-service-mails`
      in :cite:t:`uv-nubus-customization`
      for information about customization of emails sent by the *End User Self Service*.

   :external+uv-ucs-operation:ref:`end-user-self-service`
      in :cite:t:`uv-ucs-operation`
      for information about customization of the *End User Self Service*
      in a Nubus for UCS environment.

.. _nubus-user-management-self-service-password-change-portal:

Change user password through the Portal
---------------------------------------

Every signed-in user can change their own password through the *Portal*.
For instructions,
see :ref:`nubus-user-password-management-change-portal`
in :ref:`nubus-user-password-management`.

.. _nubus-user-management-self-service-password-change-app:

Password management in the End User Self Service
------------------------------------------------

The *End User Self Service* is a separate web application.
Users find the same modules in the *Portal* at
:menuselection:`User menu --> User settings`.
It offers the following modules:

* *My Profile*
* *Protect your account*
* *Change your password*

Alternatively, you can reach the *End User Self Service*
directly through the endpoint ``/univention/selfservice/``.

.. _nubus-user-management-self-service-contact-info:

Contact information
-------------------

Users can save additional personal data at the user account object in the *Directory Service*.
The personal data can include the following information:

* Profile picture
* Contact information, such as a private address

By default, only administrators can modify user contact information.
With the *End User Self Service*
you can enable end users
to manage selected account attributes themselves.
:numref:`nubus-user-management-self-service-contact-info-figure`
shows how editing the user profile data looks like.

.. _nubus-user-management-self-service-contact-info-figure:

.. figure:: /images/users_self-service_profile.*
   :alt: User profile through the *End User Self Service*
   :width: 484px

   User profile through the *End User Self Service*

.. _nubus-user-management-user-registration:

User registration
-----------------

The *End User Self Service* allows users to register themselves.
The registration creates a user account
that the user must verify through email.

The user workflow for the self registration is the following:

#. User creates their account in the
   *Create an account* dialog,
   see :numref:`nubus-user-management-user-registration-figure`.

#. The *End User Self Service* sends an email for account verification to the provided email address.

#. The user opens the page to verify the account
   using the URL from the invitation email.
   See :ref:`nubus-user-management-user-registration-email-verification`.

#. The user verifies the account using the token from the invitation email.
   See :ref:`nubus-user-management-user-registration-account-activation`.

User accounts that users created through the *End User Self Service*
have the ``RegisteredThroughSelfService`` attribute set to the value ``TRUE``
and the ``PasswordRecoveryEmailVerified`` attribute set to the value ``FALSE``.
After the user has verified their email address and completed the registration procedure,
the ``PasswordRecoveryEmailVerified`` has the value ``TRUE``.

:numref:`nubus-user-management-user-registration-figure`
shows the *Create an account* dialog during self registration.

.. _nubus-user-management-user-registration-figure:

.. figure:: /images/users_self-service_registration.*
   :alt: Account registration
   :width: 463px

   Account registration

For the *Create an account* configuration in Nubus for UCS,
see
:external+uv-ucs-operation:ref:`end-user-self-service-registration-registration-form`
in :cite:t:`uv-ucs-operation`.

.. _nubus-user-management-user-registration-email-verification:

Email verification
~~~~~~~~~~~~~~~~~~

After a user clicked :guilabel:`Create account` in
:ref:`nubus-user-management-user-registration`,
the *End User Self Service* shows a message
similar to
:numref:`nubus-user-management-user-registration-email-verification-figure`
that it sent an email for
:ref:`nubus-user-management-user-registration-account-activation`.

.. _nubus-user-management-user-registration-email-verification-figure:

.. figure:: /images/users_self-service_verification_email.*
   :alt: Sending the verification email
   :width: 871px

   Sending the verification email

For the verification email configuration in Nubus for UCS,
see
:external+uv-ucs-operation:ref:`end-user-self-service-registration-email-verification`
in :cite:t:`uv-ucs-operation`.

.. _nubus-user-management-user-registration-account-activation:

Account activation
~~~~~~~~~~~~~~~~~~

After the user follows the link in the account verification email,
the *End User Self Service* shows *Account verification* page similar to
:numref:`nubus-user-management-user-registration-account-activation-figure`.
It contains the username and the token from the verification email.

.. _nubus-user-management-user-registration-account-activation-figure:

.. figure:: /images/users_self-service_verification.*
   :alt: Account verification
   :width: 483px

   Account verification

If the user clicks :guilabel:`Verify Account`,
the *End User Self Service* confirms with an account verification message similar to
:numref:`nubus-user-management-user-registration-account-activation-verification-message-figure`.

.. _nubus-user-management-user-registration-account-activation-verification-message-figure:

.. figure:: /images/users_self-service_verification_message.*
   :alt: Account verification message
   :width: 340px

   Account verification message

.. _nubus-user-management-user-deregistration:

User deregistration
-------------------

The *End User Self Service* allows users to request the deletion of their user account.

If a user has requested to delete their user account,
Nubus deactivates the user account and doesn't delete it directly.
In addition,
it sets the ``DeregisteredThroughSelfService`` attribute of
the user object to the value ``TRUE``
and the ``DeregistrationTimestamp`` attribute of the user account
to the current time in the `GeneralizedTime LDAP syntax <ldap-generalized-time_>`_.
If the user account has the ``PasswordRecoveryEmail`` attribute set with an email address,
the *End User Self Service* sends a notification email.

.. _ldap-generalized-time: https://ldapwiki.com/wiki/Wiki.jsp?page=GeneralizedTime