Fine-grained access control

A single billing account (Metaname account) can have multiple user accounts.

The user accounts feature is enabled on a per-account basis and billed at a flat rate of NZ$64+GST per year. Please write to us if you'd like to give it a test-drive.

Are they a good fit?

User accounts are useful if you would like:

• the ability to retire access for staff members that move on without affecting access for everyone else,

• separate credentials for staff or contractors that need to update DNS zones but not register, cancel or transfer out domain names,

• the audit trail to indicate who made that change at 2am on Thursday night. We can't help with what they were thinking at the time unfortunately,

• your accounts staff to be able to:

  • see the full ledger of transactions in the account if they want to investigate any unexpected line items,

  • have a complete history of invoices issued,

  • use a projection of anticipated account balance taking upcoming renewals in to account,

  • load new payment card details,

  • check the invoice ledger to see how that $0.09 discrepancy arose.

Security

• Distinct: Each user account has its own set of credentials (e-mail address, password, MFA secret).

• Digested: Metaname does not store passwords, only a one-way digest of each password.

• MFA is required for every user account. It's not possible to have a user account that doesn't require MFA.

• Privileges: Each user account is granted any combination of the following privileges:

  • Admin for managing other user accounts,

  • Finance for the staff in accounts,

  • Lifecycle for registering, transferring, renewing and cancelling domain names,

  • Tech for service delivery, such as changing name servers or editing DNS zones.

• Account credentials: The credentials associated with the billing account are still valid (just in case you delete your last admin account), so it's best to protect them with MFA and a ridiculously strong password.