Archived - How do I manage user groups and user permissions? (Entuity v20.0)

System user groups and user profiles

To create a user group

To set up user group membership

To set user group tool, report and task permissions

To delete a user group

To expire the passwords of all users in a selected group

To reset the settings of all users in a selected group to the global settings

To edit the groups to which a user belongs

To specify which servers a user group can see

Recommended best practices for setting up user groups and user permissions across multiple servers

User groups are means to determine the permission level of individual user accounts. You can associate individual user accounts with one or more user groups, and in doing so can meet the varied requirements of different types of users.

User groups need to be set up for all authentication types (internal, external and RSSO) on all servers.

System user groups and user profiles

There are two predefined system user groups:

• Administrators.
  • this group allows users full access to Entuity's functionality.
  • you cannot delete the Administrators group, and it must always have at least one member.
• All Users.
  • all user profiles belong to the All Users group.

There are two predefined user profiles:

• admin - a member of both Administrators and All Users.
• user - a member of All Users.

To create a user group:

1. In the Main Menu, click Administration.
2. Click Account Management. Under the Groups tab on the Account Management page, click Add.
   
   
   
   
3. This opens the Add Group window. Enter a name for the group in the Enter a group name field and click OK to save, otherwise click Cancel.
   
   
   
   
4. The group is then created. By default, all users are excluded from a group when it is first created.

To set up user group membership:

1. Under the Groups tab on the Account Management page, click Edit Users.
2. This opens the Edit Group Members window. All of the users currently excluded from the group are in the left-hand column (Non-members), whilst all of the users currently included in the group are in the right-hand column (Members).
3. To move users between the columns, select the user (or multiple users via the ctrl or shift keys) and click the left or right arrow between the columns.
4. Click OK to save, otherwise click Cancel.

To set user group tool, report and task permissions:

Members of the Administrators user group have full access to all Entuity tools, reports, tasks and reports. They also have access to all objects managed by Entuity.

You can assign permissions to users by giving permissions to groups that they are members of. It is through membership of user groups that users gain their permissions. This is done by taking the union of the permissions for all groups the member is a user of. For example, if a user belongs to two user groups, with one permitting access to a function and the other denying access, the user will have access to that function.

To delete a user group:

You can only delete custom user groups. You cannot delete the predefined system user groups, which are Administrators and All Users.

When deleting a user group, Entuity also deletes the membership of user accounts to that group, but does not delete the individual user accounts themselves.

1. Under the Groups tab on the Account Management page, select the user group you want to delete, and click Remove.
2. A deletion confirmation window will open. Click Yes to confirm the delete, otherwise click No.

To expire the passwords of all users in a selected group

1. Under the Groups tab on the Account Management page, select the user group for which you would like to expire all passwords. This will take effect the next time the users in the selected group each individually log in. Note, you can only select one group at a time.
2. Click Expire Passwords. A confirmation window will open, click Yes to confirm, otherwise click Cancel.

To reset the settings of all users in a selected group to the global settings:

1. Under the Groups tab on the Account Management page, select the user group for which you would like to reset the settings to the global settings. Note, resetting to global settings does not reset the user specific settings.
2. Click Reset User Settings. A confirmation window will open, click Yes to reset the settings of all users in the selected group to the global settings, otherwise click Cancel.

To edit the groups to which a user belongs:

1. Under the Users tab on the Account Management page, select the user for whom you would like to edit group membership.
2. Click Edit Groups. This will open the Edit User Membership: <user> window.
3. Using the arrow buttons, select and move the user groups between the Available groups column and the Member of column.
4. Click OK to save your changes, otherwise click Cancel.

To specify which servers a user group can see:

You can specify the servers that the members of a user group can see. When specified, members of the user group will be restricted to seeing data only from the specified servers.

To specify which servers a user group can see:

1. Navigate to the Groups tab on the Account Management.
2. Select the user group that you want to edit, and then click Edit Servers to open the Edit Group Servers: <user group> window.
3. Select the available servers that you want to move between the Excluded and Included columns. If a server is in the Included column, the user group will have access to data on that server.
4. Click OK to save your changes, otherwise click Cancel.

Recommended best practices for setting up user groups and user permissions across multiple servers:

Entuity recommends mirroring configuration across all servers as far as possible. This would require you to create the same user groups on each server, and then add the same permissions to each group on each server. Account Administration can be undertaken through the UI via the steps above, or via Entuity's RESTfulAPI functionality.

However, there are circumstances where you might want to have different permissions per server, for example in the case of MSPs who might want to keep access between customer servers separate. In this case, you will need to go to the individual server and change the permissions there, e.g. turning off permissions for Customer B on Customer A’s server.