Signing in

The admin console is at /admin/login on whichever host your organisation's Omaya runs on. There is no separate app to install.

What the form asks for

Three things, and the first one surprises people:

Organisation — a short identifier for your organisation, not your company's full name. One Omaya installation serves many organisations, each with its own separate database, so the login has to know which one you belong to before it can look your username up. Whoever set your account up will have given you this; it is usually a lowercase word with no spaces.

Username and password — your own.

Remember me keeps you signed in on that browser. Separately, the browser remembers which accounts have signed in on it before and offers them as cards above the form, so the second visit is usually one click. Those cards live in a cookie on that browser only — they are a convenience, not a session, and "forget" on a card removes it.

A link that fills the organisation in for you

/admin/login?tenant=yourorg pre-fills the organisation field. Worth putting in your own onboarding email or intranet page, because the organisation field is the one new colleagues get stuck on.

/admin/login?tenant=yourorg&sso=1 skips the form entirely and goes straight to your identity provider.

Signing in with your company account (SSO)

If your organisation has configured single sign-on, the login page offers it as well as the password form. Omaya supports OpenID Connect, so Entra ID, Google Workspace, Okta and anything else that speaks OIDC will work.

Three things worth knowing about how it behaves here:

• SSO is configured per organisation, on Configuration → SSO. Your identity provider is yours; nothing is shared with other organisations on the same installation.
• Your organisation can be made SSO-only, which switches the password form off. That is the right setting once everyone has moved across, because a password that still works is a password that can still be phished.
• Omaya does not ask for a second factor after SSO. Your identity provider has already decided how strongly to authenticate you, and asking again would be theatre. Set MFA policy there, not here.

There is also email-domain routing, set up by whoever operates the platform: if your domain is registered, typing a work address is enough to send you to the right organisation's identity provider without choosing from a list.

Two-factor authentication

For password sign-in, Omaya supports a time-based code from an authenticator app (Google Authenticator, 1Password, Authy — any TOTP app).

Set it up at /admin/mfa/setup: scan the QR code, then enter one code to prove the clock agrees. After that, each password sign-in asks for the current code. Five wrong codes and the attempt is thrown away and you start again from the login form.

If you lose the device, an administrator of your organisation has to reset it for you from the Admins page. There is no self-service route, on purpose.

Forgotten passwords

Forgot password on the login form emails you a link. The link is single-use and expires; if you request several, only the newest one works.

You may also be asked to change your password when you sign in — that is an administrator having required it, not a fault.

Too many wrong passwords

Five failed attempts and that username is locked out briefly from that address. Wait a minute rather than trying harder — repeated attempts extend nothing but your own wait.

Where you land, and what you can see

Signing in takes you to the dashboard — worth reading about, because two of its default tiles are the most misread numbers on the platform. From there the left-hand menu is your whole platform, and the menu tour explains every item on it.

The menu is not the same for everyone, and this is the single most common confusion after a new colleague's first day:

• Nearly every page is permission-gated. Your role decides which items appear at all. If a colleague is looking at a page you cannot find, compare roles on Administration → Roles before assuming anything is broken.
• Some pages belong to apps. If the app is not enabled for your organisation, its pages are not in your menu. That is a licence question, not a fault.
• The SYSOP menu is not yours. It is for whoever operates the whole platform and reads across every organisation. Most people will never see it, and nothing in it is needed to run your own site.

If you operate the platform

Superusers sign in the same way and get one extra ability: from SYSOP → Tenant you can switch into an organisation and browse as though you belonged to it. Everything you then do is scoped to that organisation, which is what makes "reproduce what the customer is seeing" a thirty-second job.

Switching organisations changes what every page reads. It is worth glancing at which one you are in before you conclude a number is wrong.

Signing out

Logout in the account menu, or /admin/logout. On a shared machine, use it rather than closing the tab — "remember me" is doing exactly what it was asked to.