Admin console and operations
Thinkfree Drive provides two admin interfaces, separate from the user interface. {drive-host} is your Drive service
domain. Access the Admin Portal through the tenant's domain. The Superadmin Portal is also reachable at the server IP
or the first tenant's domain.
| Interface | Role | Login URL |
|---|---|---|
| Admin Portal | Tenant Admin manages users, system settings, security, and branding for their tenant. | https://{drive-host}/admin/login |
| Superadmin Portal | Super Admin manages the whole system and every tenant. | https://{drive-host}/superadmin/login |
These URLs open the login page if you are signed out, or the corresponding portal's management page if you are already signed in.
If you ran the trial image in Set up Drive, open the Admin Portal or Superadmin Portal on the computer running the container and sign in with the trial accounts listed there. To change the admin interface language, open the profile icon in the upper right and select Account Settings. The default is the browser language.
The trial guide uses a local IP address instead of a domain. Some admin features that depend on a domain may not work correctly in this environment. To test multi-tenant operation, configure a domain for each tenant, enable TLS, and access Drive over HTTPS.
The default passwords for the superadmin and admin accounts that ship with the installation are public. Change
them before you operate the service. The Superadmin Portal shows a Password Setup Guide when you sign in with an
account whose password has never been changed.
Admin Portal
Tenant administrators manage users and service settings within their own tenant.
Accounts
| Menu | Function |
|---|---|
| Accounts > Users | Add, edit, deactivate, and delete users. Users cannot sign up themselves; an administrator creates their accounts. |
| Accounts > Admin | Manage administrator accounts the same way as users. |
| Accounts > Pending Deletion | Restore or permanently delete deleted accounts. |
- Add a user: User ID (email), password, name, and storage quota are required. The default storage quota is 1 GB.
- Bulk registration: Download the CSV template from the registration screen, fill in the user list, and upload it with Import. Select Send email to send account registration details to each registered user. Email delivery requires SMTP configuration.
- Change password / reset 2FA: On the user edit screen, change the password, or reset 2FA for a user who lost or replaced their authentication device. The reset button is disabled for users who have not registered 2FA.
- Security history: Check the location, IP, and time of the user's sign-ins and sign-outs.
- Deactivate / delete: Deactivated users cannot sign in. A deleted account stays in the Pending Deletion list for 30 days, during which it can be restored, and is then permanently deleted automatically.
You cannot delete or deactivate the account you are currently signed in with.
System Settings
| Menu | Function |
|---|---|
| System Settings > System Information | Check the current tenant's domain and product version. The product version is read-only. |
| System Settings > SMTP | Configure the SMTP server for account registration and notification emails. After saving, use Send test email to confirm it works. |
| System Settings > License | Check the license validity period and type, and renew by uploading a new license file. Seat-based licenses also show seat usage and limits. |
| System Settings > Office | Set the Thinkfree Office server address and adapter name. |
| System Settings > Storage | Check the connected storage type and connection information. |
| System Settings > Note (Beta) | Turn the Intellect Note feature on or off. When off, the note menu is hidden from users. |
- Check the license validity period and renew before it expires.
- In Office settings, enter the Thinkfree Office server address and the name of an adapter registered in that Office instance. For the Office side, see Admin console and operations.
- Storage type and connection information are read-only in the Admin Portal. You can change the single file upload size limit.
Security & Auth
2FA
In Security & Auth > Authentication > 2FA, you can require two-factor authentication for regular users in the tenant. It is disabled by default and does not apply to admin or super admin sign-in. If a user loses or replaces their authentication device, reset that user's 2FA in Accounts > Users > Edit.
Login method
Select the login method in Security & Auth > Authentication > Login Settings.
| Method | Description |
|---|---|
| Local Login | Sign in with email and password. This is the default. |
| JWT Auto Authentication | Authenticate automatically, without a login screen, with a JWT issued by a trusted external system. |
| OIDC Login | Sign in through an external OpenID Connect provider (IdP). |
If you select JWT Auto Authentication, enter these items.
| Item | Required | Description |
|---|---|---|
| Provider Name | ✓ | Name that identifies the JWT provider |
| Issuer | ✓ | Issuer identifier that must match the JWT's iss value |
| Login Page URL | ✓ | Your login page URL to redirect to when token authentication fails or a user opens Drive directly |
| Audience | - | JWT audience value |
| Email Claim Name | - | Name of the claim to read the email from |
| Key Type | ✓ | public_key to enter a public key directly, or jwks to retrieve keys from a JWKS endpoint |
| Public Key | When using public_key | Public key used to verify the JWT signature |
| JWKS URI | When using jwks | JWKS URL from which to retrieve keys for JWT signature verification |
If you select OIDC Login, add an IdP. You can register several IdPs, but only one is connected at a time.
| Item | Required | Description |
|---|---|---|
| IdP Name | ✓ | Name that distinguishes the IdP |
| Issuer URL | ✓ | IdP issuer URL |
| Client ID | ✓ | Client identifier issued by the IdP |
| Client Secret | ✓ | Client secret issued by the IdP. It is masked after registration. |
A login method change applies to subsequent sign-ins by regular users. It does not sign out existing sessions or change how admins and super admins sign in. Check the values before saving.
API Keys
In Security & Auth > API Keys, create and manage API Keys for external integrations. External systems use these keys to call APIs for tasks such as user account management, bulk registration, and storage quota management. See Authentication for API usage and permissions.
- Key Generation: Enter an API Key name, purpose, and expiration date. The default validity period is 90 days. The full API Key value is shown only once, right after creation, so store it somewhere safe immediately.
- Deactivation / Activation: A deactivated API Key cannot be used for subsequent API calls. You can activate it again when needed, but even an active API Key cannot be used after it expires.
- Change expiration date: Update the expiration date as needed. Extending a deactivated API Key does not activate it automatically.
- Re-issuance: Revokes the existing API Key value and replaces it with a new one, keeping the same expiration date. The new value is also shown only once, so update the settings of every system that uses it. Reissuing an expired API Key alone does not make it usable again.
Access Control
In Security & Auth > Access Control, specify the countries and IP ranges from which regular users can connect. It is disabled by default. If you configure both countries and IPs, matching either allows access. If you configure only countries, IPs whose country cannot be determined are not blocked.
Saved policies apply to subsequent requests. These restrictions do not apply to administrator accounts; allowed IPs for administrator access are configured separately in the Superadmin Portal.
| Item | Format | Example |
|---|---|---|
| Allowed Countries | ISO two-letter country code | KR, US, JP |
| Allowed IPs | IP address or CIDR | 192.168.0.12, 192.168.0.0/24 |
Audit Log
In Security & Auth > Audit Log, view the history of sign-ins, file access, sharing, permission changes, and administrative actions. Only accounts with admin permission can view logs and export them to CSV.
| Filter | Description |
|---|---|
| User | Search by name or email. Matching users appear as autocomplete suggestions. |
| Search Period | Set the start and end dates. |
| Event | Select multiple categories and specific events, such as Login, File/Folder, Sharing, User Management, or Settings. |
| Result | Select All, Success, or Failure. |
| Channel | Select All or one channel: Web, API, MCP, or SYSTEM. |
The list shows User, Event, Result, Resource, Target, Channel, IP, and Occurred At. Run a search with your chosen filters, then select Export to download matching logs for the tenant across all result pages as a CSV file. Each export can cover up to 92 days. To query logs through the API, see Audit logs.
Audit logs can contain personal data such as user names, email addresses, and IP addresses. Thinkfree Drive is a customer-operated product, so the customer is responsible for access permissions, retention, and disposal of log data.
Service
| Menu | Function |
|---|---|
| Service > Branding | Set the browser title and service name, and use the default logos or upload your own favicon, symbol logo (login screen), primary logo (sidebar), and email logo. |
| Service > Feature > Sharing | Set Enable Sharing, Allow External Sharing, and Access Permission Scope (Restricted, Organization-internal public, Public). |
Disabling sharing and saving removes all existing shares for files and folders owned by that tenant. Restricting external sharing or public access can also remove the affected shares and permissions. Allowing sharing again does not restore removed shares; you must share those files and folders again. Apply to All in the Superadmin Portal applies the change to every tenant.
Superadmin Portal
The super admin manages the entire Drive system and all tenants. Multi-tenant operation requires both domains and TLS (HTTPS). Drive identifies the tenant by the domain used to access it, so each tenant's domain must be configured to serve Drive over HTTPS.
If an allowed IP for Superadmin Portal access was set in the properties file at installation, the portal is reachable only from those IPs.
| Menu | Function |
|---|---|
| Tenant Management > Tenant List | View, add, and edit tenants. Tenant deletion is not supported. |
| System Settings > System Information | Set the base domain for the system and check the product version. |
| Service Feature Management > Sharing Settings / Login Settings | Apply sharing and login methods to all tenants at once or to each tenant separately. |
| Account Settings | Check the Superadmin account information. |
Add a tenant
Save the base domain in System Settings before you add a tenant. When you add one, enter the Tenant Name, Tenant Domain, Allowed Access IP, and Admin Representative Account. Allowed Access IP restricts access to the Admin Portal. If you leave it empty, administrators can access the portal from any IP. You can change the allowed IPs later.
The Admin Representative Account can be entered only when the tenant is created. Create additional admin accounts in that tenant's Admin Portal.
Switching sharing or login settings to Apply to All enforces the common settings across all tenants and prevents tenants from changing them individually. Each tenant's saved settings are retained and take effect again when you switch back to individual application. Shares already removed by a sharing policy change are not restored.