Skip to content

Database authentication

The default db method stores users, password hashes, profile fields, and access levels in the MRBS database.

$auth["type"] = "db";
$auth["session"] = "php";

Initial administrator

On an empty installation, MRBS prompts for the first administrator account. Afterward, administrators manage users through the web interface.

User administration

Database authentication supports:

  • user creation and deletion;
  • administrator access levels;
  • password changes and resets;
  • profile fields such as display name and email; and
  • protection of selected fields from user edits.

The default protected fields are:

$auth['db']['protected_fields'] = array(
    'level',
    'name',
    'display_name'
);

Password reset

Password reset depends on a valid user email address and correctly configured outgoing mail. The reset key has a limited lifetime:

$auth['db']['reset_key_expiry'] = 60 * 60 * 24;

Test the entire reset flow before relying on it for account recovery.

User deletion

MRBS can prevent deletion of users referenced by bookings:

$auth['db']['prevent_deletion_of_users_in_bookings'] = true;

This can preserve attribution and reporting integrity. Decide whether your retention and privacy policy favors preserving the account record or removing personal data.

Operational guidance

  • Give each person an individual account.
  • Do not share administrator credentials.
  • Protect mail delivery used for password reset.
  • Review administrator accounts regularly.
  • Back up the database because it contains the complete identity store.