All users are displayed to not logged-in users?

[tvdeew 4]

Hi,

emby 4.6.4.0 running on Windows here.

When nobody is logged in, all my users are displayed in the web gui. This is a nice feature for people forgetting their usernames, but on the internet it's a privacy nightmare.

How can I change this? All my users do have the "Hide on Logon Screen" checkbox set, but they are display anyway.

[GrimReaper 4740]

Are you hiding them locally or remotely? 

[Carlo 4561]

Hi, there are 2 options to control this.  One is for local login and one for remote.  Make sure you get these set correctly.

Hide this user from login screens on the local network
Hide this user from login screens when connected remotely <-- enable this to hide the user on remote connections

[tvdeew 4]

Ah, found it, thank you. I have used "remote", but my local proxy is ... always "remote". I feel like a moron now

Thank you both.

Edited August 6, 2021 by tvdeew

[Carlo 4561]

Yea, a proxy can change how this works a bit so you need to take that into consideration.

If you're adventurous you could leave the 2 mentioned options above disabled (allowing login) but instead enable this option

"Hide this user from login screens on devices they've never signed into"

So that way the logins never show unless you've already logged in once on that device.  This can be nice for "remote family" as you can have an account for your brother, sister-in-law and their 2 kids.  As each logs in on the living room system in their house the logins will now appear for them.  That would then allow them a quicker switch among their family.

But to anyone else hitting your server would never see those logins.

[gillmacca01 211]

Sorry to hijack this thread, but a quick question.

If I enabled 'Hide this user from login screens on devices they've never signed into' and the user attempts to sign in to 'never used before' device, what happens?

Are they just refused, or does the admin of the server receive an email to authorize access (and how would an admin authorise access to a specific device)

[GrimReaper 4740]

You mean autorized user or someone unknown? 

[gillmacca01 211]

Authorized user.

As an example: a user has access to iphone and ipad only, but try's to log into their tv

[GrimReaper 4740]

That's not what this function is for, it ain't access control, it is only for hiding that user from login screen on any device he hasn't signed in before. That means he has to login manually the first time. After that, on every subsequent login from that same device he will be listed in login screen in addition to Manual login and Forgot password fields 

[gillmacca01 211]

ok, thanks for the clarification

[Carlo 4561]

It's a new option added to 4.6 server.

It actually allows you to have logins similar to "Netflix" or "Hulu".

It's pretty cool I think and gets rid of the security issue of just showing logins to anyone who hits the server remotely.

Each family or set of friends only get their own logins.

[Luke 42079]

58 minutes ago, gillmacca01 said:

Sorry to hijack this thread, but a quick question.

If I enabled 'Hide this user from login screens on devices they've never signed into' and the user attempts to sign in to 'never used before' device, what happens?

Are they just refused, or does the admin of the server receive an email to authorize access (and how would an admin authorise access to a specific device)

Based on the description of the option alone, what do you think would happen?

[gillmacca01 211]

In my head, if a user did not have permission to use a device, or an unknown user tried to access a device the admin would receive an email where they could authorize/deny use of the device, but I am happy the way it works

[Luke 42079]

Just now, gillmacca01 said:

In my head, if a user did not have permission to use a device, or an unknown user tried to access a device the admin would receive an email where they could authorize/deny use of the device, but I am happy the way it works

But if you read the description of the option, this is not about permissions.

[gillmacca01 211]

Description says 'filtering user device access will prevent them from using new devices until they've been approved here', so I presumed (obviously wrong) that I would have to tick the new device to give them access, which, to me, is the same as giving permission to access emby on the new device.

I thought it would be similar to when you want to link an emby connect to an account - the admin receives an email to confirm

Edited August 6, 2021 by gillmacca01

[Luke 42079]

5 minutes ago, gillmacca01 said:

Description says 'filtering user device access will prevent them from using new devices until they've been approved here', so I presumed (obviously wrong) that I would have to tick the new device to give them access, which, to me, is the same as giving permission to access emby on the new device.

I thought it would be similar to when you want to link an emby connect to an account - the admin receives an email to confirm

That's not the setting you asked the question about though, so that is different.

[Carlo 4561]

"Hide this user from login screens on devices they've never signed into"

That is the option Luke was asking about.