Create a person and issue a key

Everyone who uses the data service is a person in it: their rules determine what they can reach, and their personal keys are their ways in—one per device or purpose.

In the Personen und Schlüssel (People and keys) area, Neue Person … (New person …) opens a card to the right of the list that asks for everything at once: who the person is, what they may do, how they sign in, and which key they get. Anlegen (Create) saves it all in one go. The key itself never appears in the app. Instead you get one-time links to pass on (a second one for the second factor), and only the person ever sees the key.

1. Open Personen und Schlüssel and select Neue Person … in the command bar. The card opens to the right of the list, where the selected person's form usually is.

2. Fill in the card from top to bottom. The most common case is preselected: read access, sign-in with a personal key, and a personal key issued.

   Field	What to enter
   Name	First and last name, unique. It appears in the log and in the audit trail
   Was darf die Person? (What may the person do?)	The Datenquelle (data source; already selected if there is only one) and Lesen (Excel, Power BI, Berichte) (Read), Lesen und ändern (Read and change), or Noch nichts – Regeln später (Nothing yet – rules later). The app finds the matching rule itself; see Notes
   Wie meldet sich die Person an? (How does the person sign in?)	Mit persönlichem Schlüssel (With a personal key), Windows-Konto (Windows account; for example CORP\jdoe, one account per person, stored by the service as a SID), or SQL-Anmeldung (SQL login; requests run under it, data source with Personen = Impersonate). The account field appears only for a Windows account or SQL login
   Schlüssel (Key)	Persönlichen Schlüssel ausstellen (Issue personal key) with the key's label in the Wofür? (What for?) field, for example Excel or Laptop (empty: Arbeitsplatz). A person who signs in with a personal key always gets one. Also select Zweiten Faktor einrichten (Set up second factor) if the person should use a code

3. Select Anlegen. If something is missing, the card says what above the buttons and saves nothing. Otherwise it shows what was set up and the one-time links with how long they're valid.
4. Select Links kopieren (Copy links), pass the links on to the person, for example by email or chat, and select Fertig (Done). The form appears on the right again, now showing the new person.

The person opens the link, selects the button, and sees their key once. Opening the link again shows nothing.

Cancel: Nothing is saved before Anlegen; Abbrechen (Cancel) closes the card. While the card is open, the app doesn't switch to another area, sign out, or close; instead it names the next step (Anlegen or Abbrechen; once the person is created, Fertig). That way neither your entries nor the links get lost.

Result: The person is selected in the list. The Schlüssel (Keys) tab shows the key with its label, its last four characters, and the state “gültig” (valid) or “ruht” (dormant). The person signs in with it in Access through the ODBC driver, in Excel or Power BI as a password with the user name pkuser (HTTP: sign-in (reference), section “Personal keys” (data service documentation)), or, with the admin right, in the administration app.

1. Select the person and choose Schlüssel (Keys) > Schlüssel ausstellen … (Issue key …).

2. In the dialog, enter a label for the key and choose its purpose: Arbeitsplatz (Workstation) or Präsentation auf Abruf (On-demand presentation). Each option says what it does.

   Purpose	Effect
   Workstation	The person's rights; the sign-in policy decides when a second factor is required, for example from outside the network
   On-demand presentation	Read-only, without a second factor (Power BI and Excel can't prompt for a code), and on demand: the key stays dormant until you activate it for a meeting; see Issue a presentation key and replace a lost key

3. The Schlüssel ausgestellt (Key issued) message shows the key's ID (k…) and the one-time link with how long it's valid.

<a id=“regeln-zuordnen”></a>To change an existing person's rules, choose Rechte (Rights) > Regeln zuordnen … (Assign rules …). Every rule appears to the right of the list with a check box, and each click is saved immediately. If you select a different person, the check boxes follow. Schließen brings back the person's form.

In the screenshot: (1) one check box per rule.

• Which rule does the person get? The service always grants rights through rules. For Lesen, the card uses a rule that grants read-only access to exactly the tables and views of the data source; for Lesen und ändern, one that grants read and write access to them. If no such rule exists, the card creates it and names it after what it does: <datasource>-lesen or <datasource>-pflege. Assign further or finer rules (single objects, several data sources) with Regeln zuordnen …; see above and Create a rule.
• Database identity and presentation key aren't part of the card: assign a database identity in the person's form, and issue an on-demand presentation key with Schlüssel ausstellen … (see above).
• The link is valid for 15 minutes, and only until the service restarts. If it has expired or the person has lost the key, select the key and choose Schlüssel (Keys) > Schlüssel neu ausstellen … (Reissue key …); see Issue a presentation key and replace a lost key.
• What applies to this person, and where? Rechte (Rights) > Anmeldung und Rechte … (Sign-in and rights …) shows, to the right of the list, wider than the form and always for the selected person: for each sign-in method and origin (company network, outside, unknown), whether the sign-in is allowed, needs a code, or is refused, and which rule causes it.
• Why can't the person get in? Zugang wiederherstellen … (Restore access …) shows their latest rejections with the cause and the fix; see Troubleshooting.
• Card width: Drag the narrow bar between the list and the card to make the card wider or narrower. The app remembers the width for your Windows account. Anmeldung und Rechte, Warum abgewiesen?, and the import temporarily take as much width as the page allows and give it back when you close them. At least 9 cm (about 3.5 in) of the list always stays visible. Page layout: Work with many people at once.
• Link previews don't reveal the key. An email program that fetches links in advance sees only the button; the key appears only after the click.
• Expiration: A key expires after the service's maximum lifetime (365 days by default). To set an earlier date, enter it in the key's form under Läuft ab (UTC) (Expires (UTC)), as a UTC time; the service rejects a later one.
• Restrictions: In the key's form, select Nur lesen (Read-only). Ohne zweiten Faktor (Without second factor) exempts a read-only key from the second factor, for Excel and Power BI, which can't prompt for a code. To limit a key to particular data sources or networks, add the attributes database (name of a data source), from, or except_from (a network, for example 10.0.0.0/8) in the key's form, once per restriction.
• Several keys per person are the intended setup: if a laptop is lost, you revoke one key, not all of them.
• Administrators are people with the verwaltung rule (admin right). They usually need a second factor; see Set up or reset the second factor.
• Self-service: People who sign in with Windows or their SQL login can issue keys to themselves if you allow it: in the Anmelderichtlinie (Sign-in policy) area, on the Einstellungen (Settings) tab, enter the lifetime in days in the Laufzeit selbst ausgestellter Schlüssel (Lifetime of self-issued keys) field (0 = off).

• Set up or reset the second factor
• Revoke a key or lock a person
• Issue a presentation key and replace a lost key
• Create a rule
• Reference: HTTP: sign-in (reference), section “Personal keys” (data service documentation), HTTP: sign-in (reference), section “Self-service” (data service documentation)