User Management - Part 1 - Introduction

User Management

Introduction

Users must be authenticated (logged in) to access iPassport. A small number of pages are an exception: external document authorisation and publishing approval, external non-conformance reporting, the external incident report form, and the unsubscribe link in email notifications are all reached from a unique link, and it is that link which authorises the visitor rather than a login. This allows external contributors, such as an external approver or someone reporting an incident, to take part without a user account.

The level of access a user has within iPassport is normally determined by their user group membership. Rights are resolved separately for each organisational unit, so the same group can give a user different access in different organisational units. Some users are not governed by their groups at all: site administrators, and facility administrators within their own facility, hold every right in the system regardless of group membership, as does the built-in admin login used by support. A view only user is limited to the rights of the fixed Global Viewer (excluding admin and personnel records) role, whatever their groups.

Each user has a unique username. How they sign in depends on the Login Strategy set for your account:

• iPassport Login — the user signs in with their username and password.
• 2-Factor Authentication Login — the user signs in with their username and password, then enters a one-time code sent to them by email.
• SAML/ADFS — the user signs in through your own identity provider. The username and password fields are not shown; the user clicks Sign in with Saml (SSO) instead. No welcome email containing a generated password is sent when a user is created on a SAML account.

When a user is created on the system, an associated staff profile and contact record are automatically generated and linked. In most cases, the recommended method is to create the user record first and let the system create the staff profile and contact records. It is possible to create contacts or staff profiles independently, for special circumstances, but there is risk of ending up with duplicate records if the user is added later: creating a user under Administration > Users always generates a fresh staff profile and contact record, and does not look for an existing one to match against.

Where a staff profile already exists, there are two supported ways to add a user account that link the two records rather than duplicating them, provided you have permission to create users:

• Open the staff profile and click Create against the user account.
• Choose the option to create a new user account while completing the staff profile itself, so that both records are created and linked in one step.

Temporary user access can be granted, for example to an external auditor. This user can have limited access to the system (view only access is recommended). View only access requires your account or the user's facility to hold at least one view only licence, and the User Accounts:Set View Only permission. It cannot be applied to a user who currently holds a reserved licence.

When they have finished accessing the system the user can be inactivated. Inactivating a user is more than an on/off switch: outstanding tasks, workflow involvement and document ownership are cleared as part of the process, and some of this has to be decided before you inactivate, such as whether to reassign the user's outstanding tasks to someone else. See Inactivating/Reactivating Users for what happens and what to decide first.

Should they require access again, the user record can be reactivated, provided you have the User Accounts:Enable/Disable permission. On an enterprise account, a user cannot be set back to active until they have a Home OU set.

Contents

• Permissions for User Management
  
• Creating User Accounts
  
• Searching and Editing User Records
  
• Inactivating/Reactivating Users
  
• User Management Tools
  
• User Importer

Next Step:

The next article covers Permissions for User Management