User Groups or single logon with multiple profiles

[Carlo 4330]

Luke's suggest would only provide a method to allow quicker login by remembering X different signins vs just the last signin.

This wouldn't give the user the ability to create a sub-account (whatever we call it) as it would still be a normal user the admin of the system would need to create and assign access rights/permission to.

In order for Emby Server to be able to delegate account/sub-account creation to a user it would need a group or parent-child type relationship, which currently doesn't exist. Based on that the dev team would likely look for all requests similar to this. Then with all the requirements in hand could design a system that would meet these needs.

Keep in mind when I say "groups" it's from an admin standpoint of grouping in some fashion. A group could be something an admin creates and ads people to "Kids Group", "Adult Group" etc or could be an internally automatically created "Cayars Group" when I create a sub account for my son and daughter.

Those are just examples, but we would not know exactly how this would be done until all the different requirements from user requests are processed as well as team input on possible other things that could be done.

Carlo

[neik 837]

11 hours ago, cayars said:

Luke's suggest would only provide a method to allow quicker login by remembering X different signins vs just the last signin.

Which could be a quick win. Just an educated guess though, as I've no clue how difficult it would be to implement.

If a more refined system is to be developed, that's also fine for me but having the ability to quickly change users would already be enough for some (majority?) of us.

[ebr 14948]

14 hours ago, cayars said:

Luke's suggest would only provide a method to allow quicker login by remembering X different signins vs just the last signin.

I also think it would be counter to what a lot of people desire in this situation.

if we're talking about a shared TV in a family, it is likely your different users have different access to different content.  So, remembering/not requiring re-authorization on multiple users would completely defeat that in terms of keeping your kids out of any content they aren't supposed to see.  They just switch to the parent account.

[neik 837]

5 hours ago, ebr said:

if we're talking about a shared TV in a family, it is likely your different users have different access to different content.  So, remembering/not requiring re-authorization on multiple users would completely defeat that in terms of keeping your kids out of any content they aren't supposed to see.  They just switch to the parent account.

That's why I suggested a PIN:

 

 

[ebr 14948]

6 hours ago, neik said:

That's why I suggested a PIN:

Right, but then that's not just what Luke suggested for a "quick win". 

I think we understand what people want here and it is interesting, but it isn't a quick or easy throw in.  It would require a pretty significant re-design and changes to most of the system.  Not saying it cannot happen - just that it isn't something that would happen overnight.

[crusher11 857]

Wouldn't most cases just be different watch histories/watch lists? Obviously the latter doesn't exist in Emby though. 

[ebr 14948]

7 hours ago, crusher11 said:

Wouldn't most cases just be different watch histories/watch lists?

One would expect all user-specific features to work properly.

[TurkeyMan 9]

I think the best way to do this is to allow multiple-logins on devices, and then have a button to quickly switch between logged-in users.

It's not correct to have accounts with no passwords, then other people in other places on other devices can access my account, and that's not right.

Currently the device remembers logins so you don't need to login every time you turn the device on. You can also set the option to hide all users on a device, only showing users who have logged in on that device before. That's all great, just allow multiple login's on the one device, and add a button to quickly switch. This should be separate to the "logout" button, authorising and de-authorising your account on a device is a different operation.

These other comments about "account groups with single login creds", or similar; anything relating to group management in general is overcomplicating the matter, and also sounds much more time consuming to implement and confusing for users.

I think it would look like this:

1. Login and "remember me" continue to work as usual, but allow a device to remember multiple login records.

2. Add a "change user" button to clients in a more accessible location; shows a list of logged-in users for the current device, plus a single item "login new user" which shows the login prompt to allow an additional login to the device without signing out the current user.

3. When switching users, the profile menu changes to that active user.

4. If the active user chooses "sign out" from the usual profile menu: a. if other users are logged in, then return to the switch-user menu and remove the logged out user from the list. b. if user was last-man-standing, follow existing flow back to sign-in screen.

Edited December 16, 2022 by TurkeyMan

[TurkeyMan 9]

Please don't do silly stuff with groups or shared passwords on this matter, etc. That's just complexity asking for trouble. The system I describe requires almost no technical changes; just allow device to remember more than 1 login. Login and account-keeping mechanics are not changed.

[ebr 14948]

4 minutes ago, TurkeyMan said:

Please don't do silly stuff with groups or shared passwords on this matter, etc. That's just complexity asking for trouble. The system I describe requires almost no technical changes; just allow device to remember more than 1 login. Login and account-keeping mechanics are not changed.

The one thing both solutions are problematic with is parental controls.  If we don't require a password when switching, then there can be no parental control - quite likely a necessity on shared family TVs.

[TurkeyMan 9]

Yeah that's fair. In a home with parental control, adult accounts probably need a pin that they enter when switching to their accounts. That's convenient enough compared to a password. I still don't really see any reason to add the complexity of groups though.

My passwords are strong; my emby instance is on the internet... can't have random people logging into my instance by guessing/brute-forcing weak passwords.

Pins can give satisfactory privacy or parental control where passwords are not practical. Passwords need to be strong, just like any passwords on the internet! But passwords that are strong can't be expected to be entered repeatedly.

Ideally, pins might be a sequence of up/down/left/right presses, because you need to be able to enter them quickly and conveniently holding a remote control.

Edited December 16, 2022 by TurkeyMan

[TurkeyMan 9]

I think the flow there would be:

1. On the "sign in" screen next to the "remember me" button, add a "use pin lock" checkbox which is only active (or appears) when "remember me" is also checked.

2. When pressing sign-in, prompt to enter a pin; it could be numeric, or a sequence of arrow presses, and the device would remember the pin together with the login record.

Pin would be device-local; the advantage of device-local pin as opposed to an account record, is that it wouldn't pollute all my other devices.

For instance, my phone, my tablet, my PC; they are all personal items, and they are already protected by screen locks, so it would be annoying for an account-local pin to also appear on those devices. The TV is the only shared device where the pin is relevant, so it should be associated with the login record local to that device. As a bonus, I reckon that's easier to implement too; no synchronising of state to worry about.

Edited December 16, 2022 by TurkeyMan

[crusher11 857]

Netflix has a "Kids" option, how does that handle parental control?

[Cheesegeezer 3089]

10 minutes ago, crusher11 said:

Netflix has a "Kids" option, how does that handle parental control?

Why don’t you ask them! This is emby

[crusher11 857]

6 minutes ago, Cheesegeezer said:

Why don’t you ask them! This is emby

I meant in terms of user experience. The back end doesn't really matter.

[ebr 14948]

23 hours ago, crusher11 said:

Netflix has a "Kids" option, how does that handle parental control?

Not very well.  They've been cobbling together the concept of different users from a baseline of not having them initially.

We are designed around users from the get-go so that's where all our functionality resides.

[Carlo 4330]

 

On 12/16/2022 at 9:41 AM, TurkeyMan said:

These other comments about "account groups with single login creds", or similar; anything relating to group management in general is overcomplicating the matter, and also sounds much more time consuming to implement and confusing for users.

I think it would look like this:

1. Login and "remember me" continue to work as usual, but allow a device to remember multiple login records.

2. Add a "change user" button to clients in a more accessible location; shows a list of logged-in users for the current device, plus a single item "login new user" which shows the login prompt to allow an additional login to the device without signing out the current user.

3. When switching users, the profile menu changes to that active user.

4. If the active user chooses "sign out" from the usual profile menu: a. if other users are logged in, then return to the switch-user menu and remove the logged out user from the list. b. if user was last-man-standing, follow existing flow back to sign-in screen.

 

On 12/16/2022 at 9:58 AM, TurkeyMan said:

Please don't do silly stuff with groups or shared passwords on this matter, etc. That's just complexity asking for trouble. The system I describe requires almost no technical changes; just allow device to remember more than 1 login. Login and account-keeping mechanics are not changed.

Please keep this in mind. There are several different feature requests here in the forums concerning users and groups. There are also other requests that would become much easier to implement when you can treat 20 people as one entity applying something once, not 20 times.

We realistically wouldn't do a rewrite being narrow focused looking at only 1 or 2 requests when we could build a solution that allows 20 feature requests to be handled. (Numbers are examples only). While this request could be done a couple of different ways using groups is the cleanest method as it also brings a lot of potential for new functionality as well.

Think about it this way.  Look at the way a network admin would setup accounts.  They would create groups for a specific purpose. A simple example is having 100 users and departments for IT, accounting, PR, sales, management, finances, reports, etc. Then there might be groups for win10, win11, linux, mac, android, ios, etc..  A new user is added to the system and is added to any group that applies to the user. There is no need to try and give specific access at the micro level when an admin can change permissions for a group and anyone a member of the group gets the new access.

How that relates to Emby is similar.  You could have groups that represent a family.  You could have a group for your household, a group for your brother, one for your sister's household and 2 groups for neighbors.  You create groups for adults, kids, anime, documentaries, camera, home-movies, Christmas, Thanksgiving, Easter, Halloween, etc.  You assign users to a family group if it applies and then add them to any "media group" that applies.  Now library management gets easier for many things.  You can have a library just for Christmas movies or Halloween movies that's always present on your system but instead of having to edit 50 users before Christmas to give them access and then again after Christmas removing them (lot of work) you instead edit the "Christmas group" and give it access to the Christmas library and poof everyone get's access.  Same with removing access.  People have wanted "templates" to use for access writes so they could pick a template and create a user.  That's great for upfront setup but doesn't help moving forward.  Groups on the other hand allow you to create a user add them to a template or set of groups like I just described and stay easy to manage.  The same goes for groups you create for other things like downloads, conversions, transcoding.

Right now, if you wanted to see what users have access to your adult library or kids library you would have to check every user.  With a group you just look at a list of group members. In the case of family groups your sister might have a shield in the living room, roku in the kitchen and master bedroom as well as two tablets. You add those devices to the family group as the only devices to be used and it applies to the whole family. Any member can use any device but no other devices.  You can add 3 other people to their account if asked so the 3 babysitters can log in but only using these approved devices.  You control the number of devices you let them use while not really caring about the number of people using the devices. With the use of the group each family can see their own quick logins but not see anyone else that isn't in their group. Your family will only see accounts from the household and not from other households, etc  It sounds complicated at first but actually makes things easier (code and management) once the group concept is in place.

[sross44 243]

Just circling back to this whole thread and reading it now. It'd be awesome (and yes I know I'm going to get flack for this) if it was somewhat setup like Plex for user selection. When I initially log in to a plex client it asks me to connect via pin (siimilar to Emy connect). Once that's done, I see all the users associated with the account. You can easily see how they're set up (kids profiles, teenager profiles etc). Once there, you can select a user without any password (unless you specify one being required). 

 

I know that Emby is setup very different than plex and I love the server as a whole for being that way. But in this one instance it is much easier to select and choose the user when you have a lot of different people tied to your server. I've got my folks, my in laws, my daughter, step sons, etc.... all logged in at different locations with multiple people being in the same household outside of the server's network. This makes it difficult for them to switch between their accounts as is.... but the Plex way does make it much more simplified. 

[amb13 17]

I second this. Having it set up as plex or netflix where one household has a "master" account and can add users as they see fit under it would improve the experience of sharing emby tenfold. As it is now, if one of my users need a separate account for their partner the user has to ask me to set it up. Would be lovely to just give access to the server to a family and then they can set up their household as they see fit. Now I basically have to micromanage 5+ families user accounts.

A lot of posts here about the ease of signing in and switching user, and this would certainly help with that, but I see this as more of a user management problem.

Could be somewhat solved by giving some users access to create and edit other users (probably only users that account has created), but not any more admin privileges. Though this is far from as elegant as the groups cayars are describing above. As of now I have to give away admin privileges to everything if I want someone else to be able to add users.

 

Edited January 20, 2023 by amb13

[dani75alves 2]

On 19/12/2022 at 07:58, cayars said:

 

 

Lembre-se disso. Existem várias solicitações de recursos diferentes aqui nos fóruns sobre usuários e grupos. Existem também outras solicitações que se tornariam muito mais fáceis de implementar quando você pode tratar 20 pessoas como uma entidade aplicando algo uma vez, não 20 vezes.

Nós realisticamente não faríamos uma reescrita focando em apenas 1 ou 2 solicitações quando poderíamos construir uma solução que permitisse o tratamento de 20 solicitações de recursos. (Os números são apenas exemplos). Embora essa solicitação possa ser feita de várias maneiras diferentes, o uso de grupos é o método mais limpo, pois também traz muito potencial para novas funcionalidades.

Pense nisso desta maneira. Veja como um administrador de rede configuraria contas. Eles criariam grupos para um propósito específico. Um exemplo simples é ter 100 usuários e departamentos de TI, contabilidade, relações públicas, vendas, gerenciamento, finanças, relatórios, etc. Então pode haver grupos para win10, win11, linux, mac, android, ios, etc.. Um novo usuário é adicionado ao sistema e é adicionado a qualquer grupo que se aplique ao usuário. Não há necessidade de tentar conceder acesso específico no nível micro quando um administrador pode alterar as permissões de um grupo e qualquer membro do grupo obtém o novo acesso.

Como isso se relaciona com Emby é semelhante. Você pode ter grupos que representam uma família. Você pode ter um grupo para sua família, um grupo para seu irmão, um para a família de sua irmã e 2 grupos para vizinhos. Você cria grupos para adultos, crianças, anime, documentários, câmeras, filmes caseiros, Natal, Ação de Graças, Páscoa, Halloween, etc. Você atribui usuários a um grupo familiar, se aplicável, e os adiciona a qualquer "grupo de mídia" aplicável . Agora o gerenciamento da biblioteca fica mais fácil para muitas coisas. Você pode ter uma biblioteca apenas para filmes de Natal ou filmes de Halloween que está sempre presente em seu sistema, mas em vez de editar 50 usuários antes do Natal para dar-lhes acesso e, novamente, depois do Natal removê-los (muito trabalho), você edita o arquivo "Natal grupo" e dê a ele acesso à biblioteca de Natal e poof todos tenham acesso. Mesmo com a remoção de acesso. As pessoas queriam "modelos" para usar para gravações de acesso, para que pudessem escolher um modelo e criar um usuário. Isso é ótimo para configuração inicial, mas não ajuda a seguir em frente. Os grupos, por outro lado, permitem que você crie um usuário, adicione-o a um modelo ou conjunto de grupos como acabei de descrever e seja fácil de gerenciar. O mesmo vale para grupos que você cria para outras coisas, como downloads, conversões, transcodificação. Os grupos, por outro lado, permitem que você crie um usuário, adicione-o a um modelo ou conjunto de grupos como acabei de descrever e seja fácil de gerenciar. O mesmo vale para grupos que você cria para outras coisas, como downloads, conversões, transcodificação. Os grupos, por outro lado, permitem que você crie um usuário, adicione-o a um modelo ou conjunto de grupos como acabei de descrever e seja fácil de gerenciar. O mesmo vale para grupos que você cria para outras coisas, como downloads, conversões, transcodificação.

No momento, se você quiser ver quais usuários têm acesso à sua biblioteca para adultos ou crianças, você deve verificar todos os usuários. Com um grupo, basta olhar para uma lista de membros do grupo. No caso de grupos familiares, sua irmã pode ter um escudo na sala, roku na cozinha e no quarto principal, além de dois tablets. Você adiciona esses dispositivos ao grupo familiar como os únicos dispositivos a serem usados e se aplica a toda a família. Qualquer membro pode usar qualquer dispositivo, mas nenhum outro dispositivo. Você pode adicionar outras 3 pessoas à conta delas, se solicitado, para que as 3 babás possam fazer login, mas apenas usando esses dispositivos aprovados. Você controla o número de dispositivos que permite que eles usem, sem se importar com o número de pessoas que usam os dispositivos. Com o uso do grupo, cada família pode ver seus próprios logins rápidos, mas não ver ninguém que não esteja t em seu grupo. Sua família só verá as contas da família e não de outras famílias, etc. Parece complicado no começo, mas na verdade torna as coisas mais fáceis (código e gerenciamento) uma vez que o conceito de grupo esteja em vigor.

Agora conseguimos chegar em uma conversa de alto nível. Seria exatamente dessa maneira, é isso mesmo, a modalidade de grupos seria exatamente assim, muita facilidade para gerenciar, cada família teria o seu próprio grupo. 

[dani75alves 2]

32 minutes ago, amb13 said:

Eu apoio isso. Tê-lo configurado como plex ou netflix, onde uma família tem uma conta "mestre" e pode adicionar usuários como bem entender, melhoraria dez vezes a experiência de compartilhamento em. Como está agora, se um dos meus usuários precisar de uma conta separada para seu parceiro, o usuário terá que me pedir para configurá-la. Seria ótimo apenas dar acesso ao servidor para uma família e então eles podem configurar sua casa como bem entenderem. Agora eu basicamente tenho que microgerenciar mais de 5 famílias de contas de usuário.

Muitas postagens aqui sobre a facilidade de entrar e trocar de usuário, e isso certamente ajudaria nisso, mas vejo isso mais como um problema de gerenciamento de usuários.

Pode ser resolvido de alguma forma dando a alguns usuários acesso para criar e editar outros usuários (provavelmente apenas usuários que a conta criou), mas não mais privilégios de administrador. Embora isso esteja longe de ser tão elegante quanto os grupos que os cayars estão descrevendo acima. A partir de agora, tenho que conceder privilégios de administrador a tudo se quiser que outra pessoa possa adicionar usuários.

 

Penso da mesma maneira, inicialmente a ideia que pensei para grupos seria basicamente assim, igual a Netflix e muito parecida com a que o @cayarsdescreveu, de que maneira seria isso: 

1- No servidor Emby o administrador criaria um grupo, por exemplo "Família do meu Irmão".

2- Nesse grupo o Administrador iria definir quantas pessoas teriam acesso, por exemplo na casa do meu irmão são 6, então seria definido 6 usuários para esse grupo como limite máximo;

3- O Administrador Emby criaria uma conta pai para este grupo, por exemplo "José"; 

4- A partir de então o Usuário "José" no grupo "Família do meu irmão" poderia criar ou excluir até 5 usuários desse grupo, ele iria gerenciar o grupo da maneira que achasse melhor.

E isso seria feito para todos os grupos, cada grupo teria uma conta pai com privilégios para criar uma conta filho. Imagino o quanto isso seria difícil no servidor Emby.

[Carlo 4330]

@dani75alves That's pretty close to how I'd envision it being done as adding a group component to the list makes for the possibility of things like this. 

It would take coding of course but instead of just one set of users that show up on the login screen it could be a very different set of users based on a "login group" the device is part of.  This way each member of "My Brother's Family" could appear on the login screen for your brother's devices but no other accounts would show up. A "My Sister's Family" could have login usernames specific to that household, etc.

 

[sross44 243]

Kills me to say this, but Jellyfin actually has this pretty perfectly setup right now. If I log in to each user via their quick connect or just with a password, I can close the app, open it back up, switch users to anyone who was logged in. Makes it pretty damn easy to switch between users. I do like the idea of the group components, but I'm wondering if it would be easier to start with at least saving the user logins like this... and then down the road adding the group component to the server? 

[neik 837]

3 hours ago, sross44 said:

If I log in to each user via their quick connect or just with a password, I can close the app, open it back up, switch users to anyone who was logged in

Apart from "quick connect" exactly what I asked for.
Additionally, we would need to make sure that kids don't log in into their parent's account, so maybe some sort of PIN for already logged in accounts would be needed

[rbjtech 4312]

6 hours ago, sross44 said:

Kills me to say this, but Jellyfin actually has this pretty perfectly setup right now. If I log in to each user via their quick connect or just with a password, I can close the app, open it back up, switch users to anyone who was logged in. Makes it pretty damn easy to switch between users. I do like the idea of the group components, but I'm wondering if it would be easier to start with at least saving the user logins like this... and then down the road adding the group component to the server? 

Is this available as a remote client ?

if local - the AndroidTV/FireTV client does this today - you can switch between users within the client just fine without the need to login ?