{"wiki":"en","slug":"guide-general-subadmin","markdown":"# Enabling the Configuration for a Sub-Administrator\n\nThis setup guide describes how you can enable the configuration for a sub-administrator.\n\nIn addition to the **administrator access**, a **user access** and a **sub-administrator access** can be set up for the Behnke Station.\n\nThe **user access** has a fixed, predefined scope of configuration rights. The administrator can specify which of the available user settings are enabled. These include, for example, the configuration of passwords, special time periods and dates, direct call keys, door opener codes, audio settings, or individual voice announcements. Settings beyond this predefined scope are not available to the user. A setup guide for the user can be found here: [Enabling the Configuration for a User](Guide_General_UserConfiguration)\n\nThe **sub-administrator access**, by contrast, is based on the administrator functions that are generally available. For the sub-administrator, you can specify precisely which areas and functions of the configuration are allowed or blocked. This makes it possible to set up an access with far-reaching administrative permissions without granting full access to all settings of the Behnke Station.\n\nThe **administrator access** has unrestricted access to the configuration of the Behnke Station.\n\n%[NOTE_REQUIRES_BASIC_SETUP](NOTE_REQUIRES_BASIC_SETUP)%\n\n\n## 1. Allowing Sub-Administration\n\n%[BS_LOGIN_INFO](BS_LOGIN_INFO)%\n\n- Click the menu item %BS_MENU_ALLGEMEIN% in the sidebar on the left\n- Navigate to the section **Sub-administration**\n\n\n\n- Set the option **Allow** to the value **Yes**\n- Click %BS_MENU_SPEICHERN_ROT% to save the configuration\n\n> [!TIP]\n> If you only want to view the sub-administration and not set it up, leave the page afterwards via **Log out** without saving. The option **Allow** then remains set to **no**.\n\n\n## 2. Setting the Sub-Administrator Password\n\nIn the **delivery state**, the sub-administrator password is `subadmin`. For security reasons, you should change this password immediately after commissioning, since a known default password poses a security risk.\n\n> [!NOTE]\n> In a future version, default passwords will no longer be used. This increases the security of our products and at the same time meets fundamental cybersecurity requirements of the Cyber Resilience Act (CRA).\n\n\n## 2.1 Permitted Characters\n\nThe following characters may be used for the sub-administrator password:\n\n```\na-z A-Z 0-9 ! ? # $ % & ( ) * + , - . / : ; = [] | { } ^ _\n```\n\n> [!TIP]\n> Choose a password that is as long as possible. The Behnke Station rates the entered password and, if the password is too simple, indicates this below the input field with the message **The current password is very insecure**.\n\n\n## 2.2 Saving the Password\n\n- Enter the new password in the option **Sub-administrator password**\n- Click %BS_MENU_SPEICHERN_ROT% to save the configuration\n\n\n## 3. Configuring the Sub-Administrator's Permissions\n\nThe sub-administrator's permissions can be configured in detail: individual areas of the configuration can be fully enabled or blocked; depending on the area, the functions available within it can additionally be individually restricted or enabled.\n\n\n## 3.1. Meaning of the Permission Values\n\nEach area is authorized via a selection field. Depending on the area, either two or three values are available:\n\n| Value | Status indicator | Meaning |\n| --- | --- | --- |\n| **no** | red dot | The sub-administrator has no access to the area. The area is not displayed to them. |\n| **partially** | yellow dot | The sub-administrator has access to some of the settings in the area. |\n| **yes** | green dot | The sub-administrator has access to all settings in the area. |\n\n- To the left of the selection field, a colored dot shows the currently set value\n- Clicking the dot switches the value of the area directly (as an alternative to the selection field)\n\n> [!IMPORTANT]\n> When assigning rights, denying takes precedence over allowing. If one setting allows access and another denies it, access is not possible.\n\n\n### 3.1 Areas Marked with **x**\n\nTo allow a complete assignment of rights, areas that are hidden due to the current configuration or missing hardware are also displayed. The areas concerned are marked with the symbol **x**.\n\nYou can already assign rights to such areas now. Which areas are marked depends on the hardware variant and the set operating mode of the Behnke Station and therefore differs from device to device.\n\n\n### 3.2 Areas / Functions\n\nThe list **Areas / Functions** corresponds to the sidebar of the configuration. The following table lists all areas in the order in which they appear in the web interface:\n\n| Area | Possible values |\n| --- | --- |\n| **Basic configuration** | **no**, **yes** |\n| **Global settings** | **no**, **yes** |\n| **General** | **no**, **partially**, **yes** |\n| **Network** | **no**, **partially**, **yes** |\n| **Analog phone** | **no**, **yes** |\n| **SIP phone** | **no**, **partially**, **yes** |\n| **IP intercom** | **no**, **partially**, **yes** |\n| **Camera** | **no**, **partially**, **yes** |\n| **Display** | **no**, **partially**, **yes** |\n| **Connection** | **no**, **partially**, **yes** |\n| **Keys** | **no**, **yes** |\n| **Handset** | **no**, **yes** |\n| **Keypad** | **no**, **partially**, **yes** |\n| **Phone book** | **no**, **partially**, **yes** |\n| **Relays** | **no**, **partially**, **yes** |\n| **Card reader** | **no**, **partially**, **yes** |\n| **Triggers** | **no**, **partially**, **yes** |\n| **Acoustics** | **no**, **yes** |\n| **Diagnostics** | **no**, **partially**, **yes** |\n| **System** | **no**, **partially**, **yes** |\n| **ControlCenter** | **no**, **yes** |\n\n> [!NOTE]\n> The areas **Sub-administration** and **Administrator password** are not included in the list. A sub-administrator fundamentally has no access to these two settings and therefore cannot assign themselves any further rights.\n\n#### Special Feature of the **Basic configuration** Area\n\nIf the sub-administrator is granted access to the **Basic configuration** area, they will find the most important settings of the other areas on one page there. The settings of areas or functions to which they have no access are hidden.\n\nIn addition, the sub-administrator is only shown warnings and configuration problems that concern settings to which they have access.\n\n> [!NOTE]\n> As a result, the device may be shown to the sub-administrator as \"generally ready for operation\" while further warnings and configuration problems appear when logging in as administrator.\n\n#### Special Feature of the **IP intercom** Area\n\nIf the device is used as an IP intercom and the sub-administrator is granted access to the **IP intercom** area, they can access other devices of the intercom system via the topology view only if a sub-administrator with the same sub-administrator password and corresponding permissions is configured in the device concerned.\n\n\n### 3.3. Functionalities\n\nIndependently of the areas of the configuration, the list **Functionalities** specifies which functions the sub-administrator may use.\n\n| Functionality | Possible values | Meaning |\n| --- | --- | --- |\n| **Door opening as sub-administrator** | **no**, **yes** | Grants or revokes the sub-administrator's permission to open the door via the web interface. |\n\n\n## 4. Saving the Permissions\n\n- Set the areas and functionalities to the desired values\n- Click %BS_MENU_SPEICHERN_ROT% to save the configuration\n- Log out via **Log out** and log in again with the **sub-administrator password** to check the assigned rights\n\n\n## 5. FAQ\n\n> [!NOTE]\n> An area is marked with x — can I still authorize it?\n>\n> Yes. The marking merely means that the area is currently hidden due to the current configuration or missing hardware. Assigning rights is still possible and takes effect as soon as the area becomes available.\n\n> [!NOTE]\n> The sub-administrator does not see an area although I set it to \"yes\"\n>\n> Check whether the area is available at all in the configuration of the Behnke Station (in the list it is then marked with **x**). Also note that denying takes precedence over allowing: if another setting denies access, the area is not accessible despite the permission.\n\n> [!NOTE]\n> Can a sub-administrator change the administrator password or give themselves further rights?\n>\n> No. The sub-administrator has no access to the sub-administration or to the administrator password.\n\n> [!NOTE]\n> Where do I set the sub-administrator password?\n>\n> In the same section **Sub-administration**, in the option **Sub-administrator password**. By default it is `subadmin`. The procedure is described on the page [Changing the Administrator Password of the Behnke Station](Guide_General_ChangeAdminPassword).\n","lastModified":"2026-10-14T13:47:15+02:00"}