Users and roles

Every person who uses Quantix should have their own account, with a role that grants only what they need.

Roles in QvDC

Role	Can do
admin	Everything, including users, licensing, updates and system settings.
System administrator	Hosts, networks, storage and images. No user administration.
VM administrator	The full VM lifecycle, including guest access.
VM operator	View VMs, power them on and off, and use their console.
operator	Manage VMs and resources.
Read-only admin	See everything, including the activity log; change nothing.
viewer	Read-only access.
none	No permissions — for accounts that get access only through additional roles.

Built-in roles cannot be edited. To customise one, open Admin Panel → People & access → Roles, use Duplicate on it, and change the copy. New role creates a role from scratch.

Prerequisites

• An account with the admin role.
• The first time you open the Admin Panel, you are asked to Secure your admin access by enrolling an authenticator app (TOTP) or a passkey.

Add a user

1. Go to Admin Panel → People & access → People and click Add user.
2. Enter the Username, Email address and an initial Password (at least 8 characters).
3. Choose the Base role (viewer by default). Tick Service account for accounts used by scripts rather than people.
4. Click Create user.
5. Give the user their username and initial password through a secure channel, and ask them to change the password and add a passkey after signing in.

Expected result: the user is listed under People and can sign in with the role you chose. Use + Assign role… under Additional roles in the user's details to grant more.

From a user's details you can also Edit, Suspend (block sign-in without deleting the account), Reactivate, Reset password and Remove them.

Passkeys

Each user can add a passkey (a fingerprint, face or security-key sign-in) under Settings → Account → Passkeys → Add a passkey. Passkeys need QvDC to be reached by its DNS name, not by IP address.

Sign in with your organization's directory

Admin Panel → People & access → Sign-in provider connects QvDC to your identity provider. Click Add provider and choose:

• OIDC (OpenID Connect) — Issuer URL, Client ID, Client secret;
• SAML 2.0 — IdP SSO URL and IdP signing certificate;
• LDAP or Active Directory — Host, Port, Use LDAPS, Bind DN, Bind password, Base DN and User filter.

Set the Default role for provisioned users — the role new users get when they first sign in through the provider. Automatic user sync (SCIM) keeps users and groups in step with your directory.

API keys

For automation, go to Admin Panel → People & access → API keys → Create API key, and choose an expiry (30 days, 90 days, 1 year or Never). The key is shown only once; store it in your secrets manager. Prefer a Service account user for automation so its access can be managed separately.

Users on a standalone host

A host's Host UI has its own local accounts, under Admin Panel → Users & Roles:

Role	Can do
Super admin	Full control of the host, including users, licensing, backups, services and host settings.
VM administrator	Create, change, power and use the console of VMs, and upload images. No host settings or user management.
Read-only admin	Look at everything, change nothing.

Click Add user, enter the Username, Password (at least 8 characters), optional Email and Role, then Create user. The built-in admin account cannot be removed or renamed; change its password under Admin Panel → Security → Change Password.

Review activity

Admin Panel → Rules & records → Activity log records who did what and when.