Identity Module — User Guide

1. Overview

The Identity area manages login accounts, roles, permissions, and related administration. Vertex ERP builds on open-source ABP Identity and presents custom Arabic screens for Users, Roles, and Audit Logs.

Business modules (HR, Evaluation, Workflow, Payroll, and others) often resolve the current person through ExtraProperties.PersonId on the identity user. Creating a user only in Identity does not attach a Person unless that link is set via HR.

2. Getting started

2.1 Recommended setup order

1. Sign in as host admin.
2. Open Roles and grant module permissions for each business role.
3. Confirm the Employee role exists (created by seed or first employee hire).
4. Create staff users manually or create HR employees (preferred for portal users).
5. For portal staff, verify login and Person-linked own-data screens.
6. Configure Setting Management (email / account) if resets and mail are needed.
7. Optionally configure tenants, white label, and audit review (host).

2.2 Main navigation

Parent menu: Administration → Identity Management.

2.3 Multi-tenancy note

MultiTenancy:IsEnabled is typically false in default appsettings. With multi-tenancy off, you operate in a single host context. Tenant menus remain useful mainly when multi-tenancy is turned on.

3. Users

Path: /identity/users
Permission: AbpIdentity.Users (+ Create / Update / Delete)

Key fields

Admin create / edit flow

1. Add user with username and password.
2. Set active, lockout, and two-factor flags as required.
3. Assign roles.
4. Save.
5. Use Permissions on a user to view rights inherited from roles (read-only in the custom UI).

Filters

Search by text and filter by role. The grid shows locked status when lockout is in effect.

Operating notes

• Prefer granting rights through roles, not direct user permissions (the custom Users screen does not save direct user permission edits).
• There is no email-invite button and no explicit Unlock action on this screen.
• PersonId is not shown or edited here — use HR employee create/update for that link.

4. Roles and permissions

Path: /identity/roles
Permission: AbpIdentity.Roles (+ ManagePermissions)

Role attributes

Known friendly labels in the product include Admin and Employee.

Permission assignment flow

1. Create or edit a role.
2. Open permission management for the role.
3. Grant or revoke permissions across Identity, HR, Evaluation, Communication, and other modules.
4. Assign the role to users on the Users screen.

Module feature access across Vertex ERP is primarily controlled here.

5. Employee accounts and Person link

Preferred business path

When HR creates an employee, the system can auto-create an Identity user:

If an employee is updated and still has no linked user, the system can ensure an account is created.

Guide rules

1. Hire in HR when the person needs portal own-data features.
2. Create Identity-only users for pure system operators who do not need a Person.
3. Evaluation, Workflow, and similar modules expect a PersonId for many actor actions.

6. Self-service account

Employees can typically change username, email, and password through the portal account tab when permitted. Admins still manage roles and activation from Identity Users.

7. Audit logs

Path: /identity/audit-logs
Permission: AuditLogs (Host)

Purpose

Review HTTP/API audit entries: who called what, when, with which status. Filters typically include user, URL, date range, and status. Entity-change summaries may appear on detail views.

Notes

• This is application audit logging, not the ABP Security Logs browser (security logs have no dedicated live screen here).
• Host-scoped: intended for system-wide review.
• Communication and other modules may keep their own audit lists under those modules.

8. Settings

Path: /setting-management

Use Setting Management for:

• Emailing configuration (needed for mail-based flows)
• Account-related settings exposed by ABP Account

Exact tabs depend on installed ABP setting contributors and permissions such as SettingManagement.Emailing and AbpAccount.SettingManagement.

9. Tenants, host hub, and branding

These screens sit in the same administration / identity system filter in the UI.

When multi-tenancy is disabled, focus on Users, Roles, Settings, and Audit. Enable multi-tenancy only when you intend to isolate organizations as tenants.

Host tooling may also support impersonation where configured; it is not a primary Identity submenu item.

10. Password policy, lockout, and two-factor

Advise users to change initial passwords and keep Active accurate for leavers.

11. What is not in the live UI

Document these as not available in the current open-source Identity UI so operators do not expect them:

12. Permissions summary

Identity (ABP)

Host administration

Related

The Employee role receives portal permissions (own HR data, leaves, agenda, and similar) — not Identity administration rights.

Parent Identity / administration system opens with Users, Roles, UserLookup, Setting Management, or Feature Management as configured in the system filter.

Appendix A — Quick procedures

A.1 Onboard a system operator

1. Roles → create role → grant needed module permissions.
2. Users → add user → assign role → Active.
3. User signs in at /account/login.

A.2 Onboard an employee portal user

1. HR → create employee with complete person data.
2. Confirm Identity user was created and Employee role assigned.
3. Employee signs in and opens portal account settings to change password.

A.3 Offboard a user

1. Users → set Active off (and remove sensitive roles).
2. Optionally delete when policy allows.
3. For employees, also complete HR exit processes.

A.4 Investigate an API action

1. Host → Audit logs.
2. Filter by user, URL, and date.
3. Open detail for status and entity changes.

Appendix B — Operating notes

Appendix C — Document control

This guide describes functional capabilities of the Identity / administration area as implemented in the Vertex ERP codebase. UI labels may appear in English or Arabic depending on language settings.