---
title: "Users and Roles"
description: "Roles in LumiScan Annotation Web (annotator, reviewer, project admin, admin), managing users, group mappings for the directory and single sign-on."
product: "LumiScan Annotation Web"
component: "lumiscan-annotation-web"
version: "2.4.1"
display_version: "2.4.1.2"
latest_version: true
language: "en"
url: "https://docs.hdvisionsystems.com/en/lumiscan-annotation-web/users-and-roles.html"
---

# Users and Roles – LumiScan Annotation Web

## Roles

| Role | May |
| --- | --- |
| Annotator | Draw and save boxes; add labels. With several annotators per image: only their own version, blind. |
| Reviewer | Compare the annotators, decide the reference annotation, see the statistics. |
| Project admin | Manage the members and the settings of the project; delete images. |
| Admin | Everything in every project, plus users, group mappings, projects (create, export, import, delete) and backups. |

The server enforces the roles; the browser only shows what a role may do.

**Server-wide roles** (Annotator, Reviewer, Admin) are set per user or per group, see below. They apply in projects that are **open to all signed-in users**. Other projects give roles to their members, see [Members and access](https://docs.hdvisionsystems.com/en/lumiscan-annotation-web/projects.html#members-and-access).

## Managing users

Admins: your name → **Users and sign-in**.

![Tab Users: search field, button Add local user, table of users with account type, the roles annotator, reviewer, admin, active, last sign-in, and the buttons Reset password and Delete](https://docs.hdvisionsystems.com/en/lumiscan-annotation-web/_images/screens/users.png)

- **Add local user**: user name, full name, e-mail, roles and a first password. Without a password, one is generated and shown once. The user must change it at the first sign-in.
- Tick the roles directly in the table. **Active** off: the user can no longer sign in, and their sessions end at once.
- **Reset password**: a new password for a local account (shown once); the user changes it at the next sign-in.
- Directory and single sign-on users appear in the list after their first sign-in. A **G** marks roles given through a group membership.

## Groups and roles {#groups}

**Groups → roles** gives a role to every member of a directory or single sign-on group:

![Tab Groups and roles: mappings of the groups Annotation Team to the role annotator and Quality Assurance to the role reviewer](https://docs.hdvisionsystems.com/en/lumiscan-annotation-web/_images/screens/groups.png)

A group matches by its name (`Annotation Reviewers`), its full DN, the last part of a Keycloak group path (`/hdvs/annotation-reviewers`) or a client role. Group roles are refreshed at every sign-in.

## Sign-in methods

The tab **Sign-in methods** shows what is configured, the redirect address to register at the single sign-on provider, and a form to **test a directory sign-in**: it shows the groups found and the roles they give, without signing in. The methods themselves are configured in the server’s configuration file, see [Sign-in Methods](https://docs.hdvisionsystems.com/en/lumiscan-annotation-web/sign-in-methods.html).

## Your own password

Local users change their password under their name → **Change password**. Passwords have at least 10 characters. Directory and single sign-on users change their password in the company directory.

![Dialog Change password: current password, new password twice](https://docs.hdvisionsystems.com/en/lumiscan-annotation-web/_images/screens/change-password.png)