First Login and Initial User

Web Management requires a login. To enable the first login at all, either a local user must be created at startup or an external login method must be set up. This applies to all installation methods.

warning

If no local user with a password exists, the login form is disabled—the fields will not accept any input. Therefore, the first local user is not created in the interface, but rather when the management system starts up.

Where the initial user comes from

Installation path	Source
Windows Setup	From the remote user you create in the setup dialog—see Windows installation . Additionally, the setup adds the user performing the installation and the local Administrators group to the Windows group OPC-Router-5-Administrators.
Docker Container	From the environment variables you provide to the container.
Edge Device Management	From the same environment variables; the platform templates query a username and password in the deployment dialog.

For container and edge installations, these are the following environment variables:

Environment Variable	Meaning
INITIAL_USERNAME	Name of the initial local user account for Web Management.
INITIAL_PASSWORD	Its password. Use either this or INITIAL_PASSWORD_FILE.
INITIAL_PASSWORD_FILE	Path to a file from which the password is read. Use either this or INITIAL_PASSWORD.

The initial user is assigned the Admin role (see User Roles ). A complete description of the variables and all other login settings can be found at Configurable Environment Variables .

note

After restarting the management system, the initial user is restored with the Admin role, even if it was deleted or modified in the meantime. This ensures that no one can be completely locked out of the management system.

Login without an initial local user

It is possible to operate entirely without INITIAL_USERNAME / INITIAL_PASSWORD if only external login methods are used:

• Pre-provisioned external users – via OR_EXTERNAL_USER_ADMIN_EMAILS (corresponding to OR_EXTERNAL_USER_EDITOR_EMAILS and OR_EXTERNAL_USER_OBSERVER_EMAILS), the OPC Router creates external users with the respective roles upon startup.
• Microsoft Entra ID – see Connecting Microsoft Entra ID/Azure AD .
• Windows Authentication – only for Windows installations; members of the local group OPC-Router-5-Administrators are assigned the Admin role. Because the setup adds the user performing the installation to this group, they can log in directly to the installed system—browsers with integrated Windows sign-in (such as Microsoft Edge or Google Chrome) will automatically use the logged-in Windows account without requiring a password. Additional requirements apply for access from other computers (HTTPS, group policies); see . Additional settings for logging in with a Windows user account can be found at .

After the first login

You can create additional users in the user management system at ; there, you can also change roles and the automatic logout times.