User Management - Part 2 - Permissions

Permissions and Settings for User Management

Required Permissions

Typically, access to the Administration menu is required to add and manage user records on iPassport. The system role, Administration Editor provides nearly all the necessary permissions (see the exception below) but also includes high level access to system settings. Therefore, it is possible to create a clerical administration role that allows creating other users on the system but doesn’t provide full access to the Administration menu.

The permissions directly related to user accounts are:

These permissions are only included in the system role, Administration Editor. The one exception is “Users:Remove Suppressed Email Address”, which is not part of that role and has to be granted separately through a custom role.

Note also that some users bypass the permission system altogether, so it is possible for someone to manage user accounts without holding any of these permissions and without the Administration Editor role:

• The internal iPassport support login passes every permission check unconditionally.
• A user with Site Admin ticked on their own user record passes every permission check unconditionally. The field is labelled ‘Site Admins can perform any action within iPassport’.
• On accounts with facilities (Enterprise Accounts), a facility administrator holds every permission in the account within the facility they administer.

If a user appears to have access that was never granted to them, check these three before reviewing their roles.

Access to Users Created

When assigning a ‘Home OU’ to new users, an administrator will only be able to choose OUs in which they have the permission, “User Accounts:Create User Accounts”. On the new user creation page, the field, Home OU, will only show the OUs where the administrator has this permission. If the administrator has the permission in their own home OU, the field will default to that OU.

The users described above are the exception. The internal support login and Site Admins can choose any OU in the account, and a facility administrator can choose any OU in the facilities they administer, whether or not they hold this permission there.

As a special condition, the permission, “User Accounts:Create User Accounts” automatically grants (user account) viewing and editing rights in the OUs where it is applied. This is to ensure administrators can always access the user records they have created.

Permissions with Additional Conditions

Two of the permissions above do not take effect on their own.

User Accounts:Set View Only

The Set read-only action is only offered on a user record when the account, or on accounts with facilities the facility, holds at least one read-only licence. Where no read-only licences are held, the action does not appear even for an administrator who has this permission. The action is also refused for a user who currently holds a reserved licence, with the message ‘This user currently has a reserved license, they cannot be set as view only.’

Setting a user as view only does more than stop them editing records. Every permission check for that user is then also checked against the system role, ‘Global Viewer (excluding admin and personnel records)’, and anything outside that role is refused regardless of the roles actually assigned to them. If that system role has been removed from the account, a view only user is refused everything.

User Accounts:Reset Passwords

On accounts which sign in through single sign-on (SSO), this permission has no effect. Neither Reset Password nor Re-send Welcome Email (resets password) is offered on a user record, and a password reset is refused if it is attempted.

Checking a User’s Effective Permissions

Rather than working out by hand what a user’s roles add up to, each user record has an Effective Permissions tab which reports the permissions that user actually holds. Type into the Search permissions field to find a permission by name, and use the OU selector to see which permissions apply in a particular OU.

[[SCREENSHOT NEEDED: The Effective Permissions tab of a user record, showing the Search permissions field, the OU selector, and the resulting list of permissions the user holds in the selected OU]]

Global Settings

There are some system preferences which influence the way user accounts behave. A description of relevant options which appear in the Miscellaneous Settings section of the System Preferences tab is offered here and further detail is available in the System Preferences user guide.

To adjust any of the preferences below:

1. Navigate to Administration > Settings > System Preferences
2. Click the row, Miscellaneous Settings
3. Locate the preference to adjust and enable/disable it by ticking/unticking the checkbox next to it, or choose a value from the list where the preference offers a list rather than a checkbox
4. Scroll down and click Save

Can Contact Support

The default setting for the user record field, ‘Can Contact Support?’ is governed by the preference, “Allow new users to contact Genial Compliance iPassport Support by default”. It can be disabled if new users should generally be prevented from contacting iPassport support and be limited to seeking internal assistance. The setting can be toggled in the field, ‘Can Contact Support?’ when a new user account is being created. When a user is allowed to contact iPassport support through this setting, the Contact iPassport Support tab in the Help area becomes visible to them.

Default Time Zone

Once a user account is created, the user’s Timezone can be adjusted. If left as ‘Not Set’, the user will be assigned the Default Time Zone declared in the Miscellaneous Settings area.

Unlike most of the preferences in this section, Default Time Zone is set by choosing a time zone from a list rather than by ticking a checkbox.

Enable Simple View

The option, Enable Simple View allows specifying whether simple view should be available in the account. Simple view offers a cut back iPassport interface without all the header menus, ideal for users who just need to complete tasks and search for content. By default users can easily switch between simple and detailed views but the user’s account can be edited to restrict them to only access iPassport in simple view.

Require password to upload new signature

Each user record includes a Signature tab where an image of the user’s signature can be uploaded so it can then be displayed, for example, in prints of documents which the user has authorised. The option, ‘Require password to upload new signature’ provides additional security so that not anyone can upload a given user’s signature.

While this option is enabled, two further restrictions apply. The Download and Delete Signature icons are hidden on an existing signature, so a stored signature cannot be retrieved or removed. The upload area also only appears on a user’s own record, so an administrator cannot upload a signature on someone else’s behalf. The password prompt asks for the password of the user the signature belongs to, not the administrator’s.

Show Inactive Users in lists

The option, Show Inactive Users in lists controls whether disabled user accounts still appear in the user lists and pickers used elsewhere in iPassport. With it disabled, disabled users are left out of those lists.

User Session Timeout

The option, User Session Timeout sets the number of minutes of inactivity after which a user is logged out.

Next Step:

The next artice covers Creating User Accounts

Previous Step:

The previous article covers User Management Overview