You need to authenticate the realm which users will log into via local administration. If you do not have an authentication server defined for local administration, create one and assign it to the realm to be authenticated. Then, create users in that authentication server. When you create each user, you are given three options -
- One-time use (disable account after the next successful sign-in)
- Enabled
- Require user to change password at next sign-in
You want to check the "one-time use" and the "enabled" boxes.
After the user logs on once, they are still in the users list for the authentication server, but they are disabled. You could either delete the account (if appropriate) or, when needed, re-enable the account for another single use.
