Self-Service Portal

Overview

The platform includes a built-in, cloud-based Self-Service Portal where the people closest to an EasyPSK group run it themselves: they see the Wi-Fi key, register and block devices, invite others and, with a Site manager role, create and maintain the groups of a whole site. Nothing in the portal reaches the administration portal.

Two portals are available, the classic one and a new one. The organization chooses its Default Portal in its self-service settings; that is the portal users land in after signing in, and a user can switch between the two from the top bar. Both share the same sign-in. This page describes the new portal.

What a member sees and does

For each group a member belongs to, the portal shows, within the member’s permissions:

• The key. The Wi-Fi network name, the key with a copy button, and a QR code to scan. The QR code is shown where a group key is in use; a Dedicated group shows a device’s own passphrase when the device is registered. A changed key can be restored for seven days.
• Devices. Every device with its type, online state and last seen time, a meter of the device cap (“used of max”), and Block or Unblock per device. A blocked device is refused even with the right key.
• Register a device. A Wi-Fi device in a few steps, or a wired device (device type and name, MAC address and description, confirm) when the group takes wired devices through MAB. Wired devices are listed apart and can be removed.
• Invite. Invite another member, worded for the group’s Self-Service Experience, for example “Invite a family member” or “Invite a colleague”.
• Print the key card. Print or download the group’s Wi-Fi Key Card from the connect guide.
• Apple Wallet. On an iPhone, iPad or Mac, Add to Apple Wallet puts the group’s key in Wallet as a pass: the network, the password, the group name, the group’s end date and the same QR code as the key card, under the logo of the default key card design. Wallet greys the pass out when the group ends; after a key change the member adds the pass again and it replaces the old one. Offered for groups with a shared key and a QR code.
• Terms. When the EasyPSK context carries terms of use and a privacy notice, a member accepts them before anything else, and again when a new version is published. The portal lists the versions a member has accepted.

A group that has ended, is archived or has reached its cap is shown as such and offers no new device or key. Members who belong to a group through a Self-Service Team are marked with a Team pill and are read-only in the member list.

Access and Login

Each tenant has a unique login URL for accessing the Self-Service Portal, with an optional global URL for broader access. The platform supports the following login methods:

• Magic Link Login: A secure email-based login with a magic link (default option; can be turned off once SAML 2.0 is configured, making the portal SAML-only).
• SAML 2.0 Federated Login (SSO): Allows Single Sign-On for enterprise environments.

The portal speaks the visitor’s language; theme and language can be changed in the account menu.

User Roles and Privileges

The platform supports role-based access control, ensuring users receive appropriate permissions. Available roles include:

1. User (Default Role):
   • View connection details, including the Pre-Shared Key (PSK) and the QR code, and the group’s devices.
2. Group Administrator:
   • Update the Pre-Shared Key (PSK).
   • Register, monitor and block devices within the group.
   • Add, update, or remove Self-Service users in the group.
3. Site manager:
   • A role above the group, defined by the administrator for one or more sites of the context. Its members are named one by one or through a Self-Service Team.
   • From the Site manager entry on the portal’s start page, a member reaches each site: its groups with their capacity and status, search by group name or a member’s address, New group (one at a time, or several as a numbered series, with the site policy’s defaults and the owner invited in the same step), each group’s members, devices and rules, and Print for Wi-Fi Key Cards or the portal poster.
   • What the role may see (groups, group users, devices, the group key, capacity use) and do (create, change and delete groups, regenerate keys, block devices, invite and remove users, print key cards) is switched on or off per role by the administrator. A member of several roles gets, per site, the union of what the roles covering that site allow. An ended group is seen but not changed.

The permissions behind a Group Administrator (User admin, Password admin, Device admin) can also be granted one by one, for example on a Self-Service Team binding or in an onboarding rule.

Self-service onboarding

Onboarding rules give a person a group of their own the first time they sign in to the Self-Service Portal. A rule names who it applies to (email domains, full addresses or Self-Service Teams) and what the new group gets: security flavour, Self-Service Experience, site, a device cap (new rules start at 30), validity in days, the member’s roles in the group, and how the group is named (a prefix and number, a name from the address, or the email address). When several rules match, the most specific wins: a full address beats a domain, and a domain beats a team. A person who already belongs to a group in the context gets no new group. The administrator can test an address against the saved rules and print a Self-Service portal poster whose QR code opens the sign-in page.

Self-Service enrollment per group is the older mechanism and remains: a group can carry an email domain filter, and a person who signs in with a matching address is added to that existing group with the role the group defines, User or Group Administrator.

Self-Service Teams and SCIM

A Self-Service Team is a named list of email addresses kept by the organization. Bound to an EasyPSK group (with the roles User admin, Password admin or Device admin, and optionally a welcome mail to new members), to an onboarding rule or to a Site manager role, it gives every member the binding’s self-service access. A person who leaves the team loses that access at once. Teams are created by hand or provisioned from the organization’s identity provider over SCIM, which also provisions the self-service identities themselves. See Self-Service Teams and Identity Provisioning (SCIM).

Self-service moves the day-to-day work (keys, devices, invitations, new groups) to the people closest to the group, while the administrator keeps the rules, the audit trail and the access control.

Related

• Administration: sites, Site manager roles, onboarding rules, key card designs and terms are defined in the administration portal.
• Sites and Site managers, Self-service onboarding and Wi-Fi Key Cards in the wiki: step by step.
• Self-Service Portal: the delegation model across every service.