Admin Console Roles

The admin console supports three roles. Each role sees only the data it is responsible for.

Role Access
SystemAdmin Everything: all domains, message search, server-wide rules, protected identities, system status, settings, maintenance, and logs
DomainAdmin One domain: that domain's overview, rules, and protected identities, plus their own mailbox
User Their own mailbox: message history, personal rules, and personalization

How Sign-In Works

The admin console does not have its own login screen. It trusts identity headers on each request:

Header Purpose
X-User-ID Who the user is
X-User-Role SystemAdmin, DomainAdmin, or User. Anything else is treated as User.
X-User-Domain The domain a DomainAdmin or User belongs to

With SmarterMail, these headers are set automatically: the user signs in to SmarterMail, and SmarterMail passes their identity through when they open the SpamFoo console. For other setups, your reverse proxy authenticates the user and sets the headers.

The console reads the current session from GET /admin/api/auth/session, which returns the user, role, and domain.

Localhost Access

Requests from the same machine that carry no identity headers get full SystemAdmin access. This is why the console works out of the box at http://localhost:16253/admin on a standalone install.

Security: Identity headers are trusted without a password check. Never expose port 16253 directly to a network. If you bind to a non-localhost address with SPAMFOO_BIND_ADDRESS, make sure only a trusted proxy or your mail server can reach it, and that the proxy strips any X-User-* headers from incoming requests before setting its own. See Setting Up Remote Access.

Viewing As Another Role

A SystemAdmin can switch the console to a DomainAdmin or User view from the role menu. This shows exactly what those roles see, which is useful for support and for checking that scoping works as expected. Only SystemAdmins can switch views.

Who Can Change What

Allow and block rules have a scope, and the scope controls who can manage them:

Rule Scope Who Can Manage It
Server-wide SystemAdmin only
Domain SystemAdmin, or the DomainAdmin of that domain
Mailbox SystemAdmin, or the mailbox owner

Next Steps