There are two types of user avatars:
Auto generated avatar- a circle with colored background and username initials inside
Image URL- a user can configure an avatar URL in their profile (feature needs to be activated in System > Settings)
If you uncheck the
Active checkbox when editing the user profile and save:
A user can be re-activated at any time. The logged-in user cannot deactivate his own profile.
If you want to see all deactivated accounts, please switch to the user listing (at System > Users) and choose
Active = No in the filter dropdown.
System accounts are users in Kimai, which are hidden in many places. They cannot be chosen from dropdowns, will be hidden in reports and more.
This setting is primarily meant to identify:
The supervisor setting is used notifications, e.g. work-contract related features, approval workflows and such.
The staff/account number appears in Exports and can be used to link users from your HR software to Kimai.
The search supports filtering by the fields:
state(active, deactivated, all)
Besides these filters, you can query for a free search term, which will be searched in the fields:
Additionally, you can filter for custom fields by using a search phrase like
This would find all entries with the custom field
location matching the term
The search terms will be found within the full value, so searching for
office would find:
I love working in my office
This office is beautiful
Our offices are very noisy
Attention: checkboxes have the values
0 (not checked) and
You can mix the search term and use multiple meta-field queries:
location:homeoffice hello- find all entries matching the search term
hellowith the custom field
locationmatching the term
location:homeoffice contract:fulltime- find all entries with the custom field combination:
expired:0finds all items whose
There are also special operators, which can be used in conjunction with custom fields (since Kimai 1.19.1):
empty string (e.g.
location:) will find all entries whose value in the
locationfield is either empty or not existing
~search term (e.g.
location:~) will find all entries that are missing the custom field (created before the field was created)
*search term (e.g.
location:*) will find all entries that have any value in the
locationfield (basically the opposite of
User registration is disabled by default, as most Kimai installations are available through the public internet.
If your Kimai installation is protected otherwise (e.g. internal network or other authentication mechanism) you can activate it through System > Settings. The self-registration is then available via a link in the login screen.
If someone registers a new account with email, username and password an confirmation email will be sent, including a link that needs to be clicked before the account will be activated. As this feature requires an email to work, you have to enable email support to use it.
The reset password function is enabled by default, you can deactivate it through System > Settings.
A user can reach it via a link from the login screen. After entering username or email-address, an email with a confirmation link will be sent. This link needs to be clicked, afterwards the user can enter a new password.
You can configure two settings to influence the security:
As this feature requires an email to work, you have to enable email support to use it.
User can log in with a username or email. Administrators can activate different login methods (like LDAP or SAML) as well.
Your login works for at least one week in the
Remember me mode.
After coming back and being remembered you have access to all the following features:
If you are an administrator, you will see all your allowed options in the menu, but will be redirected to a special confirmation/login form when you try to access them. This is a security feature to prevent abuse in case you forgot to log-out in public environments.
Kimai supports 2FA (Two-Factor) authentication via TOTP tokens.
The basic flows looks as this:
The 2FA-mode can be enabled per account, settings can be access by the user himself or by any Super-Admin.
The two-factor authentication can be enabled by all users, even for SAML accounts.